CVE-2025-1931

It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash. This vulnerability affects Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8...

CVE-2025-27220

A flaw was found in Ruby's CGI gem. The CGI::UtilescapeElement method is vulnerable to Regular expression Denial of Service ReDoS, allowing a specially crafted input to cause a high CPU consumption. Mitigation Mitigation for this issue is either not available or the currently available options do...

MAL-2025-2130 Malicious code in testaaa11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee9af0a167a9449542aeee6148dd5d89d3f9e387e437198cb1a5a3b99e074fd2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-27423

A flaw was found in the tar.vim plugin of Vim. This vulnerability allows arbitrary command execution via specially crafted tar archives that exploit the unsanitized :read ex command...

Unauthorized Channel Content Export

github.com/mattermost/mattermost-server is vulnerable to unauthorized channel content export. The vulnerability is due to improper access control due to failing to restrict channel export of archived channels when the "Allow users to view archived channels" setting is disabled...

CVE-2025-27221

A flaw was found in the URI ruby gem package, where userinfo leakage can occur in the uri gem. The methods URIjoin, URImerge, and URI+ retained userinfo, such as user:password, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using...

PT-2025-9737 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 134.0.6998.35 Description: The issue allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. Recommendations: For versions prior...

PT-2025-9710 · Unknown · Mysiteforme

Name of the Vulnerable Software and Affected Versions: mysiteforme versions prior to 2025.01.1 Description: A SQL injection issue exists. Recommendations: For versions prior to 2025.01.1, update to version 2025.01.1 or later to resolve the issue...

PT-2025-9718 · Sourcecodester · Sourcecodester Best Church Management

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Church Management Software version 1.1 Description: A critical vulnerability has been found in the software, affecting an unknown functionality of the file /admin/app/web crud.php. The manipulation of the encryption argume...

GO-2025-3482 Mattermost fails to invalidate all active sessions when converting a user to a bot in github.com/mattermost/mattermost-server

Mattermost fails to invalidate all active sessions when converting a user to a bot in github.com/mattermost/mattermost-server...

GO-2025-3484 Navidrome allows an authentication bypass in Subsonic API with non-existent username in github.com/navidrome/navidrome

Navidrome allows an authentication bypass in Subsonic API with non-existent username in github.com/navidrome/navidrome...

GO-2025-3466 Missing rate limit in MaysWind ezBookkeeping in github.com/mayswind/ezbookkeeping

Missing rate limit in MaysWind ezBookkeeping in github.com/mayswind/ezbookkeeping...

GHSA-3MF5-R4HG-HFX9 mavo DOM Clobbering vulnerability

A DOM Clobbering vulnerability in mavo v0.3.2 allows attackers to execute arbitrary code via supplying a crafted HTML element...

CVE-2024-43169

CVE-2024-43169 affects IBM Engineering Requirements Management DOORS Next versions 7.0.2, 7.0.3, and 7.1. The IBM security bulletin identifies the vulnerability as a Reflected File Download where a user could download a malicious file without verifying code integrity. The IBM CVSS context lists a...

CVE-2024-8261 IDOR in Proliz Software's OBS

Authorization Bypass Through User-Controlled Key vulnerability in Proliz Software OBS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects OBS: before 24.0927...

CVE-2024-47092 Insecure deserialization and improper certificate validation in Checkmk Exchange plugin check-mk-api

Insecure deserialization and improper certificate validation in Checkmk Exchange plugin check-mk-api prior to 5.8.1...

MAL-2025-1910 Malicious code in owl.carousel.custom (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-1893 Malicious code in meli-tools (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-1878 Malicious code in linkedin-sdk (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-23881 WordPress LJ Custom Menu Links Plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in littlejon LJ Custom Menu Links lj-custom-menu-links allows Reflected XSS.This issue affects LJ Custom Menu Links: from n/a through = 2.5...