CVE-2024-42175

HCL MyXalytics is affected by a weak input validation vulnerability. The application accepts special characters and there is no length validation. This can lead to security vulnerabilities like SQL injection, XSS, and buffer overflow...

CVE-2024-9132 The administrator is able to configure an insecure captive portal script

The administrator is able to configure an insecure captive portal script...

CVE-2025-22814

Cross-Site Request Forgery CSRF vulnerability in Dylan James Zephyr Admin Theme zephyr-modern-admin-theme allows Cross Site Request Forgery.This issue affects Zephyr Admin Theme: from n/a through = 1.4.1...

Product Walkthrough: How Reco Discovers Shadow AI in SaaS

As SaaS providers race to integrate AI into their product offerings to stay competitive and relevant, a new challenge has emerged in the world of AI: shadow AI. Shadow AI refers to the unauthorized use of AI tools and copilots at organizations. For example, a developer using ChatGPT to assist wit...

PT-2025-2598 · Joomla +2 · Joomla! +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a lack of output escaping in the id attribute of menu lists. This could potentially lead to issues where user input is not...

CVE-2024-56828

File Upload vulnerability in ChestnutCMS through 1.5.0. Based on the code analysis, it was determined that the /api/member/avatar API endpoint receives a base64 string as input. This string is then passed to the memberService.uploadAvatarByBase64 method for processing. Within the service, the...

CVE-2024-45555

Memory corruption can occur if an already verified IFS2 image is overwritten, bypassing boot verification. This allows unauthorized programs to be injected into security-sensitive images, enabling the booting of a tampered IFS2 system image...

PT-2025-2704 · Qualcomm · Snapdragon +9

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves memory corruption during the processing of a specific IOCTL call related to FIPS encryption or decryption validation functionality...

ABB Cylon Aspect 3.08.03 Hard-coded Secrets

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB Cylon Aspect BMS/BAS controller contains multiple instances o...

CVE-2024-56828

CVE-2024-56828 affects ChestnutCMS up to 1.5.0. The /api/member/avatar endpoint accepts a base64 data URL, decodes the payload via the service’s uploadAvatarByBase64, and derives a file suffix from the encoded content (substring from the 11th character to the first semicolon). The decoded data is...

Upcoming CVE for End-of-Life Node.js Versions

Upcoming CVE for End-of-Life Node.js Versions The Node.js Project is committed to ensuring the security and reliability of applications built on Node.js. As part of this commitment, we regularly review measures to help our users stay informed about security risks. Announcement We will soon issue ...

CVE-2024-56828

File Upload vulnerability in ChestnutCMS through 1.5.0. Based on the code analysis, it was determined that the /api/member/avatar API endpoint receives a base64 string as input. This string is then passed to the memberService.uploadAvatarByBase64 method for processing. Within the service, the...

CVE-2002-20002

Removed by vendor...

PT-2025-11346

Name of the Vulnerable Software and Affected Versions PHP versions 8.1. through 8.1.31 PHP versions 8.2. through 8.2.27 PHP versions 8.3. through 8.3.18 PHP versions 8.4. through 8.4.4 Description The issue is related to the insufficient validation of end-of-line characters in user-supplied...

CVE-2024-47921 Smadar SPS – CWE-327: Use of a Broken or Risky Cryptographic Algorithm

Smadar SPS – CWE-327: Use of a Broken or Risky Cryptographic Algorithm...

MAL-2025-973 Malicious code in requeszs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d8c95a5f64dd212c781d6b3c45eb03f38bcf5220f688c4d903e9bfca20911b62 Importing the module downloads and starts an infostealer attempting to exfiltrate data and establishing persistence through autorun directory. --- Category:...

MAL-2025-975 Malicious code in reqzest (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 32fb197467e37327d9d2b079a85faa4ffffa0cdc05c9703957a9f36de8f453e6 Importing the module downloads and starts an infostealer attempting to exfiltrate data and establishing persistence through autorun directory. --- Category:...

GO-2024-3344 Malicious plugin names, recipients, or identities causing arbitrary binary execution in filippo.io/age

Malicious plugin names, recipients, or identities causing arbitrary binary execution in filippo.io/age...

Builder.ai Database Misconfiguration Exposes 1.29 TB of Unsecured Records

Cybersecurity researcher Jeremiah Fowler discovered a 1.2TB database containing over 3 million records of Builder.ai, a London-based AI software and app development company. Discover the risks, lessons learned, and best practices for data security...

This VPN Lets Anyone Use Your Internet Connection. What Could Go Wrong?

A free VPN app called Big Mama is selling access to people’s home internet networks. Kids are using it to cheat in a VR game while researchers warn of bigger security risks...