17029 matches found
RUSTSEC-2025-0042 Uninitialized read after allocating MemBump
The affected function, MemBump::new, would allocate memory without initializing it. Subsequently calling the created value's various alloc methods would then read and write the start of that memory as a Cell which is undefined behavior. Instead, it should zero initialize the start of the allocate...
MAL-2025-6558 Malicious code in node-db-indicator (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 7c9a18fe9ea04133e7de33313046092ffb5e8ccef6c1bf5f44e9b6d5e3835aa2 Code download and executes a remote script. At the time of analysis, the remote code just runs a notepad - as so classified as a pentest/research. --- Category...
Hash Collision Attack
llamaindex is vulnerable to Hash Collision Attack. The vulnerability is due to the use of MD5 hashing for generating document chunk IDs, which allows an attacker to exploit hash collisions by creating structurally distinct chunks with identical text...
BELL-CVE-2025-38338
Bulletin has no description...
BELL-CVE-2025-38328
Bulletin has no description...
BELL-CVE-2025-38344
Bulletin has no description...
BIT-MARIADB-MIN-2023-39593
Insecure permissions in the sysexec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed...
BIT-DOTNET-2025-30399 .NET and Visual Studio Remote Code Execution Vulnerability
Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network...
Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON
Connect2id Nimbus JOSE + JWT before 10.0.2 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the...
OSV-2025-544 Heap-buffer-overflow in N_BELE_RTP::LEPolicy::get32
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=430110068 Crash type: Heap-buffer-overflow READ 4 Crash state: NBELERTP::LEPolicy::get32 PackLinuxElf32::elflookup PackLinuxElf32::PackLinuxElf32help1...
PT-2025-29206 · Undefined · Undefined
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. affected versions not specified Description: The issue has been rejected as not used. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...
Emerson ValveLink Products 安全漏洞
Emerson ValveLink Products is a diagnostic software from Emerson USA. A security vulnerability exists in Emerson ValveLink Products, which stems from an inadequate protection mechanism that makes it susceptible to targeted attacks...
PT-2025-29840 · Wegia · Wegia
Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.5 Description: WeGIA is an open source web manager designed for the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability exists in the adicionar especie.php endpoint. Thi...
PT-2025-29245
Name of the Vulnerable Software and Affected Versions: Apache Commons Lang versions 2.0 through 2.6 Apache Commons Lang3 versions 3.0 through 3.17.9 Description: The ClassUtils.getClass method can cause a StackOverflowError when processing excessively long inputs. This error can lead to applicati...
CVE-2025-52994
gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...
Chall-Manager's scenario decoding process does not check for zip bombs
Impact When decoding a scenario i.e. a zip archive, the size of the decoded content is not checked, potentially leading to zip bombs decompression. Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly...
CVE-2025-32053 affecting package libsoup for versions less than 3.0.4-6
CVE-2025-32053 affecting package libsoup for versions less than 3.0.4-6. A patched version of the package is available...
OS Command Injection
mcp-remote is vulnerable to OS command injection. The vulnerability is due to crafted input from the authorizationendpoint response URL when connecting to untrusted MCP servers, which allows an attacker to execute arbitrary operating system commands...