PT-2025-35774

Name of the Vulnerable Software and Affected Versions: versions prior to the patched version Description: The attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute for...

MobSF Path Traversal in GET /download/<filename> using absolute filenames

Summary The GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWDDIR download directory from "neighboring" directories whose absolute paths begin with the same prefix as DWDDIR e.g., .../downloadsbak,...

kernel: vsock: Fix transport_* TOCTOU

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix transport TOCTOU Transport assignment may race with module unload. Protect newtransport from becoming a stale pointer. This also takes care of an insecure call in vsockuselocaltransport; add a lockdep assert. BUG: unab...

Linux Distros Unpatched Vulnerability : CVE-2024-31510

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in Open Quantum Safe liboqs v.10.0 allows a remote attacker to escalate privileges via the cryptosignsignature parameter in the...

ASB-A-388029380

In checkPermissions of SafeActivityOptions.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Are Enterprises Ready for Quantum-Safe Cybersecurity?

Quantum computing threatens to undermine classical cryptography by breaking widely deployed encryption and signature schemes. This paper examines enterprise readiness for quantum-safe cybersecurity through three perspectives: i the technologist view, assessing the maturity of post-quantum...

CVE-2008-20001

activePDF WebGrabber version 3.8.2.0 contains a stack-based buffer overflow vulnerability in the GetStatus method of the APWebGrb.ocx ActiveX control. By passing an overly long string to this method, a remote attacker can execute arbitrary code in the context of the vulnerable process. Although t...

Linux Distros Unpatched Vulnerability : CVE-2025-46718

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with limited sudo privileges e.g. execution of a single...

Linux Distros Unpatched Vulnerability : CVE-2023-51847

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in obgm and Libcoap v.a3ed466 allows a remote attacker to cause a denial of service via thecoapcontextt function in the src/coapthreadsafe.c:297:3...

Linux Distros Unpatched Vulnerability : CVE-2022-21653

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Jawn is an open source JSON parser. Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext are...

MAL-2025-42076 Malicious code in safe-winston (npm)

The package safe-winston was found to contain malicious code...

Malicious code in safe-winston (npm)

The package safe-winston was found to contain malicious code...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a path traversal vulnerability in rsync [CVE-2024-12088]

Summary IBM Watson Speech Services Cartridge is vulnerable to a path traversal vulnerability in rsync, due to an issue when using the --safe-links option, where the client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it...

CVE-2025-40779

CVE-2025-40779 affects Kea DHCP server: when a DHCPv4 client unicast request includes specific options and Kea cannot select a subnet, kea-dhcp4 aborts with an assertion. Affected versions are Kea 2.7.1–2.7.9, 3.0.0, and 3.1.0. Public advisories and Nessus plugins indicate fixes in Kea 3.0.1 (and...

kernel: sch_hfsc: make hfsc_qlen_notify() idempotent

In the Linux kernel, the following vulnerability has been resolved: schhfsc: make hfscqlennotify idempotent hfscqlennotify is not idempotent either and not friendly to its callers, like fqcodeldequeue. Let's make it idempotent to ease qdisctreereducebacklog callers' life: 1. updatevf decreases...

Exploit for CVE-2025-38676

CVE-2025-38676 — Linux Kernel ≤ 6.17-rc2 AMD IOMMU stack buf...

Linux Distros Unpatched Vulnerability : CVE-2018-21000

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in the safe-transmute crate before 0.10.1 for Rust. A constructor's arguments are in the wrong order, causing heap memory corruption...

Linux Distros Unpatched Vulnerability : CVE-2024-50306

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5, from...

Exploit for Improper Handling of Exceptional Conditions in Apache Struts

PoC: Apache Struts2 CVE-2017-5638 Safe Educational Demo...

Linux Distros Unpatched Vulnerability : CVE-2016-9865

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in phpMyAdmin. Due to a bug in serialized string parsing, it was possible to bypass the protection offered by PMAsafeUnserialize functio...