17029 matches found
MAL-2025-6034 Malicious code in @secsol5g/qlik-sense (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e6e893d70e9cadaa903bd52251f94e0ad33fa06117a157e4fe4fe513a8224f1 Any computer that has this package installed or running should be considered...
CVE-2025-53941
Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Versions prior to 0.6.5 allow HTML form elements to be submitted, making the software vulnerable to HTML injection. Version 0.6.5 fixes the issue...
CVE-2025-53928 MaxKB has RCE in MCP call
MaxKB is an open-source AI assistant for enterprise. Prior to versions 1.10.9-lts and 2.0.0, a Remote Command Execution vulnerability exists in the MCP call. Versions 1.10.9-lts and 2.0.0 fix the issue...
WordPress Transposh WordPress Translation plugin <= 1.0.8.1 - Remote Code Execution vulnerability
Remote Code Execution vulnerability discovered by Julien Ahrens in WordPress Plugin Transposh WordPress Translation versions = 1.0.8.1...
Improper Certificate Validation
couchbasenetclient is vulnerable to improper certificate validation. The vulnerability is due to improper configuration defaults and lack of hostname verification in TLS connections, defaulting to IP addresses instead of hostnames, which allows an attacker to perform man-in-the-middle MitM attack...
BELL-CVE-2025-40777
Bulletin has no description...
BELL-CVE-2025-24294
Bulletin has no description...
Improper Authorization
authentik is vulnerable to Improper Authorization. The vulnerability is due to missing session validation for single-use tokens in RAC endpoints, which allows an attacker to reuse a valid token from a shared URL to access another user’s session...
ROS-20250717-01
GLPI asset and data center management software vulnerability is related to incorrect access restrictions in the API. Exploitation of the vulnerability could allow an attacker, acting remotely, to gain access to sensitive information...
PT-2025-29928 · Unknown · Haichang Oa
Name of the Vulnerable Software and Affected Versions: Haichang OA version 1.0.0 Description: The software contains a SQL Injection vulnerability. A remote attacker can obtain sensitive information via the if parameter in hcit.project.rte.agents.UploadImages.class. Recommendations: Update to a...
PT-2025-29921 · Netwrix · Netwrix Directory Manager
Name of the Vulnerable Software and Affected Versions: Netwrix Directory Manager versions through 2025-05-01 Description: Netwrix Directory Manager is susceptible to a cross-site scripting issue. Recommendations: Netwrix Directory Manager versions through 2025-05-01: At the moment, there is no...
PT-2025-29927 · Island Lake · Island Lake Webbatch
Name of the Vulnerable Software and Affected Versions: Island Lake WebBatch versions prior to 2025C Description: Island Lake WebBatch is susceptible to Remote Code Execution through a crafted URL. Recommendations: Update Island Lake WebBatch to version 2025C or later...
PT-2025-31427 · Dell · Dell Smartfabric Os10
Name of the Vulnerable Software and Affected Versions: Dell SmartFabric OS10 Software versions prior to 10.6.0.5 Description: Dell SmartFabric OS10 Software is susceptible to a Use of Hard-coded Password issue. A local attacker with low privileges could potentially exploit this, leading to...
CVE-2025-53833
LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection SSTI, which could potentially lead to Remote Code Execution RCE in vulnerable configurations. Attackers could execute...
CVE-2025-53818
GitHub Kanban MCP Server is a Model Context Protocol MCP server for managing GitHub issues in Kanban board format and streamlining LLM task management. Version 0.3.0 of the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Serv...
Eclipse GlassFish is vulnerable to Server Side Request Forgery attacks through specific endpoints
In Eclipse GlassFish version 6.2.5, it is possible to perform a Server Side Request Forgery attack using specific endpoints...
WordPress Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin plugin <= 4.48 - Broken Access Control Vulnerability
Broken Access Control Vulnerability discovered by Mika in WordPress Plugin Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin versions = 4.48...
WordPress Animator plugin <= 3.0.16 - Cross Site Request Forgery (CSRF) Vulnerability
Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Animator versions = 3.0.16...
WordPress JetSearch plugin <= 3.5.10.1 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by stealthcopter in WordPress Plugin JetSearch versions = 3.5.10.1...