CVE-2025-27610

Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, Rack::Static can serve files under the specified root: even if urls: are provided, which may expose other files under the specified root: unexpectedly. The vulnerability occurs becaus...

CVE-2025-27610

Rack::Static in Rack (Ruby) is vulnerable to Local File Inclusion due to improper sanitization of user-supplied paths, allowing access to files under the configured root. The affected versions are prior to 2.2.13, 3.0.14, and 3.1.12, which contain the patch. The vulnerability enables traversal vi...

Minor update (7) for Vivaldi Desktop Browser 7.1

Download Vivaldi The following improvements were made since the sixth 7.1 minor update: Chromium Backported Upstream 134+ security patch for "Out of bounds write in GPU" CVE-2025-24201 Main photo byAndrew Ly...

PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode()

Impact Due to lack of limits by default in the explode function, malicious clients were able to abuse some packets to waste server CPU and memory. This is similar to a previous security issue published in https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-gj94-v4p9-w672, but with a...

CVE-2025-22603

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Versions prior to autogpt-platform-beta-v0.4.2 contains a server-side request forgery SSRF vulnerability inside component or block Send Web Request. The...

CVE-2025-25306 Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes

Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the id and url fields of ActivityPub objects. An attacker can forge an object where they claim authority in the url field even if the specific ActivityPub...

CVE-2024-52812 LF Edge eKuiper has Stored XSS in Rules Functionality

LF Edge eKuiper is an internet-of-things data analytics and stream processing engine. Prior to version 2.0.8, auser with rights to modify the service e.g. kuiperUser role can inject a cross-site scripting payload into the rule id parameter. Then, after any user with access to this service e.g...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-53150)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-53150 advisory. - In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-53206)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-53206 advisory. - In the Linux kernel, the following vulnerability has been resolved: tcp: Fix use-after-free of nreq in...

CVE-2024-58055

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: Don't free command immediately Don't prematurely free the command. Wait for the status completion of the sense status. It can be freed then. Otherwise we will double-free the command...

scsi: megaraid_sas: Fix for a potential deadlock

...

xsk: fix OOB map writes when deleting elements

...

jfs: fix array-index-out-of-bounds in jfs_readdir

...

CVE-2024-53145 affecting package kernel for versions less than 5.15.176.3-1

CVE-2024-53145 affecting package kernel for versions less than 5.15.176.3-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-53693 QTS, QuTS hero

An improper neutralization of CRLF sequences 'CRLF Injection' vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to modify application data. We have already fixed the...

CVE-2024-53692 QTS, QuTS hero

A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute arbitrary commands. We have already fixed the vulnerability in the following versions:...

CVE-2024-50390

CVE-2024-50390 affects QNAP QuRouter/QHora vulnerability described as a remote command injection. Evidence across sources indicates the issue allows executing arbitrary commands and is mitigated by a patch in QuRouter 2.4.5.032 and later. The NVD entry lists a high-severity impact (CVSS 3.1: CRIT...

CVE-2025-22869 affecting package cert-manager for versions less than 1.11.2-20

CVE-2025-22869 affecting package cert-manager for versions less than 1.11.2-20. A patched version of the package is available...

GHSA-6QVP-39MM-95V8 com.xwiki.confluencepro:application-confluence-migrator-pro-ui Remote Code Execution via unescaped translations

Impact A user that doesn't have programming rights can execute arbitrary code when creating a page using the Migration Page template. A possible attack vector is the following: Create a page and add the following content: confluencepro.job.question.advanced.input=/html async async="true"...

CVE-2025-21843

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: avoid garbage value in panthorioctldevquery 'prioritiesinfo' is uninitialized, and the uninitialized value is copied to user object when calling PANTHORUOBJSET. Using memset to initialize 'prioritiesinfo' to avoid th...