Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the /api/v1/user endpoint returning different responses for failed authentication attempts depending on whether a username exists. An attacker can enumerate valid usernames by analyzing the variations in...

PT-2026-6156

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel's virtio transports are susceptible to an issue where the transmission TX credit is derived directly from peer buf alloc, which is determined by the remote endpoint's SO...

PT-2026-26670

Name of the Vulnerable Software and Affected Versions GNU C Library versions 2.34 through 2.43 Description The GNU C Library contains a flaw where calling the gethostbyaddr or gethostbyaddr r functions with a specific nsswitch.conf configuration utilizing the library’s DNS backend may lead to a...

PT-2026-5130

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description A flaw exists in libsoup where an attacker controlling the input for the Content-Disposition header can inject CRLF Carriage Return Line Feed sequences into the header value. These sequences...

PT-2026-22157

Name of the Vulnerable Software and Affected Versions FTP GVfs backend affected versions not specified Description A flaw exists in the FTP GVfs backend where a malicious FTP server can exploit the system by providing a crafted passive mode PASV response containing an arbitrary IP address and por...

PT-2026-25938

CVE-2026-4359 A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver. https://t.co/CeMfkBeSoo...

CVE-2025-15394

A vulnerability was detected in iCMS up to 8.0.0. Affected is the function Save of the file app/config/ConfigAdmincp.php of the component POST Parameter Handler. The manipulation of the argument config results in code injection. The attack can be launched remotely. The exploit is now public and m...

EUVD-2022-55927

H3C SSL VPN contains a user enumeration vulnerability that allows attackers to identify valid usernames through the 'txtUsrName' POST parameter. Attackers can submit different usernames to the loginsubmit.cgi endpoint and analyze response messages to distinguish between existing and non-existing...

EulerOS Virtualization 2.13.0 : avahi (EulerOS-SA-2025-2605)

According to the versions of the avahi package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where...

CVE-2025-15248

A security flaw has been discovered in sunhailin12315 product-review 商品评价系统 up to 91ead6890b4065bb45b7602d0d73348e75cb4639. This affects an unknown part of the component Write a Review. Performing manipulation of the argument content results in cross site scripting. The attack is possible to be...

CVE-2023-54258

CVE-2023-54258: In the Linux kernel CIFS code, a race between deferred closes and lease breaks can cause an unmount (kill_sb) to occur before validating tcon->ses during oplock_response, risking a use-after-free. The fix is to reorder checks before sending oplock_response: first ensure openFil...

CVE-2023-54203 ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds in initsmb2rsphdr When smb1 mount fails, KASAN detect slab-out-of-bounds in initsmb2rsphdr like the following one. For smb1 negotiate56bytes , initsmb2rsphdr for smb2 is called. The issue occurs whil...

CVE-2023-54203

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds in initsmb2rsphdr When smb1 mount fails, KASAN detect slab-out-of-bounds in initsmb2rsphdr like the following one. For smb1 negotiate56bytes , initsmb2rsphdr for smb2 is called. The issue occurs whil...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-992701)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992701 advisory. In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid potential UAF in nvmetreqcomplete An nvme target -queueresponse operation...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-992593)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992593 advisory. In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix bad unlock balance in l2capdisconnectrsp conn-chanlock isn't acquired befor...

curl: HTTP/2 and HTTP/3 Header Injection in curl

================================================================================ VULNERABILITY REPORT: HTTP/2 and HTTP/3 Header Injection in curl ================================================================================ VULNERABILITY TYPE: Response Header Injection / HTTP Response Splittin...

CVE-2025-15126

A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this vulnerability is the function getPositionUserList of the file /sys/position/getPositionUserList. This manipulation of the argument positionId causes improper authorization. The attack may be initiated remotely. The complexi...

CVE-2025-15175 SohuTV CacheCloud AppController.java appCommandAnalysis cross site scripting

A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. Affected by this issue is the function doAppList/appCommandAnalysis of the file src/main/java/com/sohu/cache/web/controller/AppController.java. Performing manipulation results in cross site scripting. It is possible to initiate the...

CVE-2025-15171

A vulnerability was identified in SohuTV CacheCloud up to 3.2.0. This affects the function index of the file src/main/java/com/sohu/cache/web/controller/ServerController.java. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly...

CVE-2025-15142 9786 phpok3w show.php sql injection

A vulnerability was identified in 9786 phpok3w up to 901d96a06809fb28b17f3a4362c59e70411c933c. Impacted is an unknown function of the file show.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and...