PT-2025-50116

Name of the Vulnerable Software and Affected Versions FortiPortal versions 7.4.0 through 7.4.5 Description An incorrect authorization issue exists in FortiPortal. An authenticated attacker may be able to reboot a shared FortiGate device by sending specially crafted HTTP requests. The issue is...

PT-2025-49639

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the dln2 probe function within the kernel's MFD Multiple Function Device driver for DLN2 devices. Specifically, when dln2 setup rx urbs fails during the probe...

PT-2025-50232

Name of the Vulnerable Software and Affected Versions OpenBMCS version 2.4 Description OpenBMCS version 2.4 contains a Cross-Site Request Forgery CSRF issue. An attacker can perform actions with administrative privileges by exploiting the sendFeedback.php API endpoint. Attackers can submit...

PCI-SIG PCI Express Integrity and Data Encryption 安全漏洞

PCI-SIG PCI Express Integrity and Data Encryption is a data encryption software from PCI-SIG, USA. A security vulnerability exists in PCI-SIG PCI Express Integrity and Data Encryption that stems from insufficient guidance for label reuse after a completion timeout, which could result in multiple...

Amazon Linux 2023 : aws-cfn-bootstrap (ALAS2023-2025-1303)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1303 advisory. Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to...

CVE-2025-12832

IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2025-13683

Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affects Devolutions Server: through 2025.3.8.0; Remote Desktop Manager: through 2025.3.23.0...

EUVD-2025-201708

Some endpoints in vulnerability-lookup that modified application state e.g. changing database entries, user data, configurations, or other privileged actions may have been accessible via HTTP GET requests without requiring a CSRF token. This flaw leaves the application vulnerable to Cross-Site...

CVE-2025-42616

Some endpoints in vulnerability-lookup that modified application state e.g. changing database entries, user data, configurations, or other privileged actions may have been accessible via HTTP GET requests without requiring a CSRF token. This flaw leaves the application vulnerable to Cross-Site...

CVE-2025-34291

Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration alloworigins='' with allowcredentials=True combined with a refresh token cookie configured as SameSite=None allows a malicio...

CVE-2025-42616 CSRF vulnerability in CIRCL Vulnerability-Lookup

Some endpoints in vulnerability-lookup that modified application state e.g. changing database entries, user data, configurations, or other privileged actions may have been accessible via HTTP GET requests without requiring a CSRF token. This flaw leaves the application vulnerable to Cross-Site...

Server-Side Request Forgery (SSRF)

apache.nms.amqp is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper URL resolution in the createRequestUrl function that treats paths beginning with // or \ as schema-relative URLs, which allows an attacker to override the intended base URL and force the server...

XML External Entity (XXE) Injection

Apache Tika is vulnerable to XML External Entity XXE injection. The vulnerability is due to improper handling of XFA content in PDFs within the tika-parser-pdf-module, where crafted XFA files can trigger XXE, allowing attackers to read sensitive files or make malicious internal or external reques...

EUVD-2025-201685

Server-Side Request Forgery SSRF vulnerability in Infinera MTC-9 version allows remote unauthenticated users to gain access to other network resources using HTTPS requests through the appliance used as a bridge...

CVE-2025-40326

In the Linux kernel, the following vulnerability has been resolved: NFSD: Define actions for the new timedeleg FATTR4 attributes NFSv4 clients won't send legitimate GETATTR requests for these new attributes because they are intended to be used only with CBGETATTR and SETATTR. But NFSD has to do...

PT-2026-20316

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.14 Apache Tomcat versions 10.1.0-M1 through 10.1.49 Apache Tomcat versions 9.0.0-M1 through 9.0.112 Older, End-of-Life EOL versions are also affected Description Apache Tomcat does not properly lim...

📄 Django 5.1.13 SQL Injection

Django version 5.1.13 remote SQL injection vulnerability scanning script. ============================================================================================================================================= | Title : Django 5.1.13 SQL Injection Scanner | | Author : indoushka | | Tested o...

Adobe Experience Manager (AEM) < 6.5.23.0 XML External Entity

Adobe Experience Manager AEM versions prior to 6.5.23.0 are affected by an XML External Entity XXE vulnerability. An attacker could exploit this vulnerability by sending a specially crafted XML request to the affected system, which could lead to unauthorized access to sensitive information or...

IBM InfoSphere Information Server 代码问题漏洞

IBM InfoSphere Information Server is a set of data integration platforms from International Business Machines IBM. The platform can be used to integrate data information obtained from various sources. A code issue vulnerability exists in IBM InfoSphere Information Server versions 11.7.0.0 through...

PT-2025-49564

Name of the Vulnerable Software and Affected Versions usememos memos version 0.25.2 Description A flaw in access control within the /api/v1/user endpoint of usememos memos allows unauthorized account creation through a specially crafted request. The issue allows attackers to bypass intended...