CVE-2025-29914: Use of Incorrectly-Resolved Name or Reference

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.3.3, if a request is made on an URI starting with //, coraza will set a wrong value in REQUESTFILENAME. For example, if the URI //bar/uploads/foo.php?a=b is passed to coraza: , REQUESTFILENAME will be...

LiteLLM command injection vulnerability

LiteLLM is an open source application from Berri AI. All LLM APIs can be called using the OpenAI format. A command injection vulnerability exists in LiteLLM version 1.40.12, which stems from mishandling of the postcallrules configuration and could lead to remote code execution...

PT-2025-12364

Name of the Vulnerable Software and Affected Versions OWASP Coraza WAF versions prior to 3.3.3 Description The issue arises when a request is made to an URI starting with //. In such cases, the REQUEST FILENAME is set incorrectly, potentially leading to a rules bypass. For instance, a request to...

PT-2025-12165

Name of the Vulnerable Software and Affected Versions BerriAI/litellm version 1.40.12 Description The issue exists in the handling of the post call rules configuration, where a callback function can be added. The provided value is split at the final '.' mark, with the last part considered the...

D-Link DIR-605L and D-Link DIR-618 have security vulnerabilities

The D-Link DIR-605L and D-Link DIR-618 are both a wireless router from China-based AUO D-Link. An Access Control Error vulnerability exists in the D-Link DIR-618 version 2.02 and the D-Link DIR-605L version 3.02, which stems from improper access control in the file /goform/formSetPortTr, and can ...

UBUNTU-CVE-2025-21619

GLPI is a free asset and IT management software package. An administrator user can perfom a SQL injection through the rules configuration forms. This vulnerability is fixed in 10.0.18...

CVE-2025-21619

GLPI is a free asset and IT management software package. An administrator user can perfom a SQL injection through the rules configuration forms. This vulnerability is fixed in 10.0.18...

CVE-2025-21619 GLPI allows SQL injection through the rules configuration

GLPI is a free asset and IT management software package. An administrator user can perfom a SQL injection through the rules configuration forms. This vulnerability is fixed in 10.0.18...

CVE-2025-21619 GLPI allows SQL injection through the rules configuration

GLPI is a free asset and IT management software package. An administrator user can perfom a SQL injection through the rules configuration forms. This vulnerability is fixed in 10.0.18...

CVE-2023-22514

CVE-2023-22514 affects Sourcetree for Mac and Sourcetree for Windows (version 3.4.14). The vulnerability is a Remote Code Execution (RCE) flaw exploitable by an unauthenticated attacker via user interaction, with a CVSS base score of 7.8 (Impact: Confidentiality, Integrity, Availability high; Att...

New 'Rules File Backdoor' Attack Lets Hackers Inject Malicious Code via AI Code Editors

Cybersecurity researchers have disclosed details of a new supply chain attack vector dubbed Rules File Backdoor that affects artificial intelligence AI-powered code editors like GitHub Copilot and Cursor, causing them to inject malicious code. "This technique enables hackers to silently compromis...

CVE-2025-21619: Improper Neutralization of Special Elements used in an SQL Command

GLPI is a free asset and IT management software package. An administrator user can perfom a SQL injection through the rules configuration forms. This vulnerability is fixed in 10.0.18...

CVE-2023-22512

CVE-2023-22512 is a DoS vulnerability in Atlassian Confluence Data Center and Server. Introduced in version 5.6, it allows an unauthenticated, network-based attacker to make a Confluence instance unavailable, with no impact to confidentiality or integrity and a high availability impact (CVSS v3.1...

CVE-2025-25616

Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams. The affected endpoint is /exams/edit-rule?examruleid=1...

GO-2025-3508 LF Edge eKuiper allows Stored XSS in Rules Functionality in github.com/lf-edge/ekuiper

LF Edge eKuiper allows Stored XSS in Rules Functionality in github.com/lf-edge/ekuiper...

Important: Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.5.0 release

Red Hat build of OpenTelemetry 3.5.0 has been released Release of Red Hat OpenShift distributed tracing provides following security improvements, bug fixes, and new features. Breaking changes: Nothing Deprecations: In the Red Hat build of OpenTelemetry 3.5, the Loki Exporter, which is a temporary...

Cloudflare Public Bug Bounty: Bypass of Cloudflare's Cache Keys and WAF via header overflow

A limitation in the HTTP request header parsing in Front Line FL processing enabled attackers to bypass defined rulesets. The maximum amount of headers being parsed by openresty was 100 HTTP headers including internal ones. This problem applied to any ruleset on HTTP headers. Attackers were able ...

PT-2025-17553 · Totolink · Totolink A810R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A810R version 4.1.2cu.5182 B20201026 Description: A stack overflow issue was discovered via the startTime and endTime parameters in the setParentalRules function. Recommendations: For TOTOLINK A810R version 4.1.2cu.5182 B20201026, as...

Improper Neutralization

laravel/framework is vulnerable to Improper Neutralization. The vulnerability is due to improper validation enforcement due to the incorrect handling of wildcard validation files., allowing user-crafted malicious requests to bypass file or image validation rules...

CVE-2025-25616

Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams. The affected endpoint is /exams/edit-rule?examruleid=1...