Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the Attach functionality. An attacker can cause excessive memory consumption on the host by repeatedly initiating CRI Attach requests, leading to resource exhaustion due to goroutin...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the Attach functionality. An attacker can cause excessive memory consumption on the host by repeatedly initiating CRI Attach requests, leading to resource exhaustion due to goroutin...

CVE-2025-20343

A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. This vulnerability is due to a logic error when processing a RADIUS...

tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve

A flaw was found in Apache Tomcat's rewrite rule processing component. This vulnerability allows security constraints to be bypassed via specially crafted HTTP requests when specific, uncommon rewrite rule configurations are in use...

tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE

A directory traversal vulnerability in Apache Tomcat caused by improper URL normalization during request rewriting. When specific rewrite rules are used, an attacker could craft a malicious request to bypass access restrictions and reach protected directories such as /WEB-INF/ or /META-INF/. If...

tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve

A flaw was found in Apache Tomcat's rewrite rule processing component. This vulnerability allows security constraints to be bypassed via specially crafted HTTP requests when specific, uncommon rewrite rule configurations are in use...

BIT-TOMCAT-2025-55752 Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled

Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the...

CVE-2025-10691

The Easy Email Subscription plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing or incorrect nonce validation on the showeditsubpage function. This makes it possible for unauthenticated attackers to delete arbitrary...

CVE-2025-10691

The CVE-2025-10691 entry concerns the WordPress Easy Email Subscription plugin (versions up to and including 1.3). The vulnerability is a Cross-Site Request Forgery caused by missing or incorrect nonce validation in the show_editsub_page() function, enabling unauthenticated attackers to delete ar...

PT-2025-45331

Name of the Vulnerable Software and Affected Versions CMSimpleXH affected versions not specified Description An unauthenticated reflected cross-site scripting issue exists in the query handling process. This allows remote attackers to inject and execute arbitrary JavaScript in a victim’s browser...

CVE-2025-63551

The MetInfo Content Management System (CMS) versions through 8.1 are vulnerable to a Server-Side Request Forgery (SSRF) flaw. This issue is caused by a defect in the XML parsing logic , which allows an attacker to perform an XML External Entity (XXE) injection. By constructing a malicious XML ent...

CVE-2025-63551

A Server-Side Request Forgery SSRF vulnerability, achievable through an XML External Entity XXE injection, exists in MetInfo Content Management System CMS thru 8.1. This flaw stems from a defect in the XML parsing logic, which allows an attacker to construct a malicious XML entity that forces the...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990407)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990407 advisory. In the Linux kernel, the following vulnerability has been resolved: gpio: davinci: Validate the obtained number of IRQs Value of pdata-gpiounbanked is taken from...

CVE-2025-63588

An unauthenticated reflected cross-site scripting vulnerability in the query handling of CMSimpleXH allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser via a crafted request e.g., a maliciously crafted POST login. Successful exploitation may lead to theft of...

The vulnerability of Dahua’s micro-programmed IP cameras lies in the improper assignment of permissions for critical resources, allowing intruders to gain unauthorized access to protected information.

The vulnerability of Dahua’s micro-programmed IP cameras is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information through a specially crafted HTTP request...

ThinkDashboard 安全漏洞

ThinkDashboard is a lightweight, self-hosted bookmarking dashboard by the individual developer MatiasDesu. A security vulnerability exists in ThinkDashboard version 0.6.7 and earlier, which stems from a server-side request forgery vulnerability in the /api/ping?url= endpoint that could lead an...

CVE-2025-63588

An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in the CMSimple_XH content management system (version 1.8). The root cause is the application's front-router parsing code , which fails to properly encode or filter dynamic inputs from the request URI. Attackers can craf...

GO-2025-4021 Omni is Vulnerable to DoS via Empty Create/Update Resource Requests in github.com/siderolabs/omni

Omni is Vulnerable to DoS via Empty Create/Update Resource Requests in github.com/siderolabs/omni...

CVE-2025-20343

A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. This vulnerability is due to a logic error when processing a RADIUS...

CVE-2025-20343

A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. This vulnerability is due to a logic error when processing a RADIUS...