6815 matches found
EUVD-2023-24016
Malicious code in bioql PyPI...
Insecure Deserialization
DeepDiff is vulnerable to insecure deserialization.The vulnerability is due to class pollution via the Delta class constructor which, when combined with a gadget in DeltaDiff, allows an attacker to modify deepdiff.serialization.SAFETOIMPORT and trigger insecure Pickle deserialization through Delt...
SeaCMS 安全漏洞
SeaCMS is a free, open source web content management system written in PHP by SeaCMS, Inc. The system is primarily designed to manage video-on-demand resources. A security vulnerability exists in SeaCMS version 13.1, which stems from an information leak in the adminsafe.php component that could...
CVE-2025-60449
An information disclosure vulnerability exists in SeaCMS version 13.1 within the admin_safe.php component located in the /btcoan/ directory. This flaw allows authenticated administrators to scan and download the application’s source code and potentially any file accessible on the server’s root di...
Renault UK Customer Records Stolen in Third-Party Breach
Renault UK warns customers of a third-party data breach exposing personal details, stressing vigilance against fraud and confirming no bank data lost...
CLSA-2025-1759420505 Fix CVE(s): CVE-2025-55212
SECURITY UPDATE: denial of Service vulnerability due to zero dimensions crash - debian/patches/CVE-2025-55212.patch: Fix invalid width or height checks in ThumbnailImage method and add safe reciprocal function to avoid division by zero - CVE-2025-55212...
CVE-2025-11020
CVE-2025-11020 affects MarkAny SafePC Enterprise. A path traversal flaw can expose server information and potentially enable SQL Injection, with an accompanying risk of Unrestricted Upload of Dangerous Type files. Impacted versions include SafePC Enterprise 5.x.x and 7.0.0 through 7.0.1 on Window...
CVE-2023-53496
In the Linux kernel, the following vulnerability has been resolved: x86/platform/uv: Use alternate source for socket to node data The UV code attempts to build a set of tables to allow it to do bidirectional socketnode lookups. But when nrcpus is set to a smaller number than actually present, the...
UBUNTU-CVE-2023-53498
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix potential null dereference The adev-dm.dc pointer can be NULL and dereferenced in amdgpudmfini without checking. Add a NULL pointer check before calling dcdmubsrvdestroy. Found by Linux Verification Center...
UBUNTU-CVE-2023-53528
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix unsafe drain work queue code If createqp does not fully succeed it is possible for qp cleanup code to attempt to drain the send or recv work queues before the queues have been created causing a seg fault. This patch...
UBUNTU-CVE-2023-53493
In the Linux kernel, the following vulnerability has been resolved: accel/qaic: tighten bounds checking in decodemessage Copy the bounds checking from encodemessage to decodemessage. This patch addresses the following concerns. Ensure that there is enough space for at least one header so that we...
CVE-2023-53530 scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Use rawsmpprocessorid instead of smpprocessorid The following call trace was observed: localhost kernel: nvme nvme0: NVME-FC0: controller connect complete localhost kernel: BUG: using smpprocessorid in preemptible...
CVE-2025-9231
Issue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel in SM2 signature computations on 64 bit ARM platforms could allow recovering the private...
PT-2025-41213
Name of the Vulnerable Software and Affected Versions Tenda CH22 version 1.0.0.1 Description A memory corruption issue exists in the formSafeEmailFilter function of the Tenda CH22 microprogram. This can be triggered by manipulating the page parameter in an HTTP request, allowing a remote attacker...
vulnerable-website
vulnerable-website This repository contains a deliberately vul...
Vaadin Flow, Hilla and the September 2025 npm supply-chain attacks
Recently two major npm supply-chain attacks have been reported, raising concerns about the safety of the broader software ecosystem, including for Vaadin users. The first incident involved compromised maintainer accounts and malicious releases of widely used packages such as debug and chalk. The...
CLSA-2025-1758825546 gimp: Fix of CVE-2025-48798
CVE-2025-48798: fix XCF loader use-after-free issues by properly managing layer/channel resources and ensuring safe cleanup during parsing...
CVE-2024-48014
Dell BSAFE Micro Edition Suite, versions prior to 5.0.2.3 contain an Out-of-bounds Write vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service...
CVE-2024-48014
Dell BSAFE Micro Edition Suite, versions prior to 5.0.2.3 contain an Out-of-bounds Write vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service...
