Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001295)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001295 advisory. The mincore implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patterns of other processes on th...

CVE-2025-36911

In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote proximal/adjacent information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-3081

Name of the Vulnerable Software and Affected Versions Google Fast Pair affected versions not specified Description A critical flaw exists in Google’s Fast Pair protocol, identified as WhisperPair CVE-2025-36911. This flaw allows nearby attackers to silently hijack vulnerable Bluetooth headphones,...

CVE-2026-0839

A weakness has been identified in UTT 进取 520W 1.7.7-180627. Affected is the function strcpy of the file /goform/APSecurity. Executing a manipulation of the argument wepkey1 can lead to buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and...

CVE-2025-15435 Yonyou KSOA work_update.jsp sql injection

A flaw has been found in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /worksheet/workupdate.jsp. This manipulation of the argument Report causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. The vend...

CVE-2025-15432

The CVE-2025-15432 issue affects yeqifu carRental, specifically the function downloadShowFile in /file/downloadShowFile.action of the com.yeqifu.sys.controller.FileController. The root cause is path traversal caused by manipulation of the path argument, allowing remote exploitation. Several sourc...

CVE-2025-15195 code-projects Assessment Management add-module.php sql injection

A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this issue is some unknown functionality of the file /admin/add-module.php. This manipulation of the argument linked causes sql injection. The attack can be initiated remotely. The exploit has been publicly...

CVE-2025-15153 PbootCMS SQLite Database pbootcms.db file access

A weakness has been identified in PbootCMS up to 3.2.12. Impacted is an unknown function of the file /data/pbootcms.db of the component SQLite Database. Executing a manipulation can lead to files or directories accessible. It is possible to launch the attack remotely. Attacks of this nature are...

CVE-2025-15153 PbootCMS SQLite Database pbootcms.db file access

A weakness has been identified in PbootCMS up to 3.2.12. Impacted is an unknown function of the file /data/pbootcms.db of the component SQLite Database. Executing a manipulation can lead to files or directories accessible. It is possible to launch the attack remotely. Attacks of this nature are...

Mozilla Thunderbird < 10.0

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 10.0. It is, therefore, affected by a vulnerability as referenced in the mfsa2012-06 advisory. - Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize...

webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop

A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser...

Adobe Experience Manager (AEM) CRX Search Endpoint Exposure

The remote Adobe Experience Manager AEM CRX search endpoint is accessible. These endpoints provide potential attackers with access to search functionalities, which could be exploited to discover sensitive internal resources. No source data...

CVE-2025-66371

Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host...

CVE-2025-66371

CVE-2025-66371 affects Peppol-py prior to 1.1.1. The issue is an XXE vulnerability caused by Saxon configuration that allows the XML parser to read local files during XML-based invoice validation, potentially exposing content to a remote host. Multiple sources (RedHat, CIRCL, OSV, NVD, Snyk, CNNV...

CVE-2025-66371

Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host...

GLSA-202511-06 : libpng: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202511-06 libpng: Multiple vulnerabilities Multiple vulnerabilities have been discovered in libpng. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block directly fro...

ROS-20251125-04

A vulnerability in OpenBao's secret management and encryption system is related to the fact that the software stores sensitive information in log files. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to confidential information...

PT-2025-47540

Name of the Vulnerable Software and Affected Versions freeprojectscodes Sports Club Management System version 1.0 Description A flaw exists in freeprojectscodes Sports Club Management System 1.0 that allows for SQL injection. The issue is located in an unknown function within the...

CVE-2025-13299

The CVE-2025-13299 entry concerns itsourcecode Web-Based Internet Laboratory Management System 1.0. Several connected sources (CNVD-2025-29439, RH/CVE-2025-13299, CNNVD-202511-1860, PT-2025-47203) confirm a SQL injection vulnerability in the file /user/controller.php. Attack surface: remote explo...

CVE-2025-13200

A vulnerability was determined in SourceCodester Farm Management System 1.0. Affected by this vulnerability is an unknown functionality. This manipulation causes exposure of information through directory listing. The attack is possible to be carried out remotely. The exploit has been publicly...