1288 matches found
CVE-2025-52901 File Browser allows sensitive data to be transferred in URL
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.9, access tokens are used as GET parameters. The JSON Web Token JWT which is used as a session identifier will get leaked to...
PT-2025-27288 · WordPress · Pt Project Notebooks
Name of the Vulnerable Software and Affected Versions: PT Project Notebooks plugin for WordPress versions 1.0.0 through 1.1.3 Description: The issue is related to missing authorization in the wpnb pto new users add function, which allows unauthenticated attackers to elevate their privileges to th...
HKUDS LightRAG allows Path Traversal via function upload_to_input_dir
A vulnerability was found in HKUDS LightRAG up to 1.3.8. It has been declared as critical. Affected by this vulnerability is the function uploadtoinputdir of the file lightrag/api/routers/documentroutes.py of the component File Upload. The manipulation of the argument file.filename leads to path...
GHSA-5VJ6-WJR7-5V9F n8n allows open redirects via the /signin endpoint
Impact This is an Open Redirect CWE-601 vulnerability in the login flow of n8n. Authenticated users can be redirected to untrusted, attacker-controlled domains after logging in, by crafting malicious URLs with a misleading redirect query parameter. This may lead to: - Phishing attacks by...
Security Bulletin: IBM Maximo Application Suite - Manage Component uses serialize-javascript-4.0.0.tgz which is vulnerable to CVE-2024-47554
Summary Security Bulletin: IBM Maximo Application Suite - Manage Component uses serialize-javascript-4.0.0.tgz which is vulnerable to CVE-2024-47554. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2024-11831 DESCRIPTION: A flaw was...
Ubuntu: Security Advisory (USN-7594-2)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
WordPress DWT - Directory & Listing Theme <= 3.3.6 is vulnerable to Privilege Escalation
Software DWT - Directory & Listing Type Theme Vulnerable versions = 3.3.6 Fixed in 3.3.7 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-12827 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID c0ebe5820838 Credit...
WordPress TimeZoneCalculator plugin <= 3.37 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by muhammad yudha in WordPress Plugin TimeZoneCalculator versions = 3.37...
Podman Improper Certificate Validation; machine missing TLS verification
Impact The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry which it does by default since 5.0.0 allowing a possible Man In The Middle attack. Patches...
GHSA-65GG-3W2W-HR4H Podman Improper Certificate Validation; machine missing TLS verification
Impact The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry which it does by default since 5.0.0 allowing a possible Man In The Middle attack. Patches...
CVE-2025-52894
CVE-2025-52894 affects OpenBao prior to v2.3.0, where an unauthenticated, unaudited cancellation of root rekey and recovery rekey operations could cause a denial of service. In OpenBao v2.2.0 and later, operators can disable the unauthed rekey endpoints on global listeners by setting disable_unau...
CVE-2025-52894 OpenBao Vulnerable to Unauthenticated Rekey Operation Cancellation
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 allowed an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, effecting a denial of...
PT-2025-26876 · Totolink · Totolink Ca300-Poe
Name of the Vulnerable Software and Affected Versions: TOTOLINK CA300-PoE version 6.2c.884 Description: A critical issue affects the setUpgradeUboot function of the upgrade.so file, allowing os command injection through the manipulation of the FileName argument. This can be exploited remotely...
CVE-2025-49147 Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements
Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1. Via a request to an anonymously authenticated endpoint it's possible to retrieve information about the configured password requirements. The informatio...
CVE-2025-49147 Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements
Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1. Via a request to an anonymously authenticated endpoint it's possible to retrieve information about the configured password requirements. The informatio...
SUSE-RU-2025:02093-1 Recommended update for podman
This update for podman fixes the following issues: - Added patch to remove using rw as a default mount option bsc1239776...
CVE-2025-52566 llama.cpp tokenizer signed vs. unsigned heap overflow
llama.cpp is an inference of several LLM models in C/C++. Prior to version b5721, there is a signed vs. unsigned integer overflow in llama.cpp's tokenizer implementation llamavocab::tokenize src/llama-vocab.cpp:3036 resulting in unintended behavior in tokens copying size comparison. Allowing...
PT-2025-26756 · Realtek · Realtek Rtl8762E Ble Sdk
Name of the Vulnerable Software and Affected Versions: Realtek RTL8762E SDK version 1.4.0 Description: The issue allows attackers to cause a Denial of Service DoS via sending a crafted message before a pairing public key is received during a Bluetooth connection attempt. Recommendations: For...