FreeRDP 缓冲区错误漏洞

FreeRDP is an open-source implementation of the Remote Desktop Protocol RDP by the FreeRDP team. Versions of FreeRDP prior to 3.24.0 contained a buffer error vulnerability. This vulnerability stemmed from the lack of checks on the predictor and stepindex values in the input data by the MS-ADPCM a...

Missing Critical Step in Authentication

Overview Affected versions of this package are vulnerable to Missing Critical Step in Authentication via the OIDC authorize process. An attacker can gain unauthorized access to valid OIDC tokens by leveraging a session where only the password has been verified but the second authentication factor...

EulerOS 2.0 SP13 : tar (EulerOS-SA-2026-1299)

According to the versions of the tar package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must...

EulerOS 2.0 SP13 : tar (EulerOS-SA-2026-1263)

According to the versions of the tar package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must...

Exploit for Path Traversal in Zenml

zenml-CVE-2024-2083-POC Dockeriz...

TencentOS Server 4: tar (TSSA-2026:0104)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0104 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2025-57622

An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loadsrequest.getdata component...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: pluto, seaweedfs-operator, teleport-operator-fips, gitlab-runner, seaweedfs-operator-fips, harbor-fips, flux-source-watcher-fips, crossplane-provider-aws-ssm-fips, tempo, crossplane-provider-aws-cloudwatchlogs, bento, kube-vip-fips, nemo, zarf,...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: pluto, seaweedfs-operator, teleport-operator-fips, gitlab-runner, seaweedfs-operator-fips, harbor-fips, flux-source-watcher-fips, crossplane-provider-aws-ssm-fips, tempo, crossplane-provider-aws-cloudwatchlogs, bento, kube-vip-fips, nemo, zarf,...

Step-Video-T2V 安全漏洞

Step-Video-T2V is an image-to-video model open-sourced by stepfun-ai. There is a security vulnerability in Step-Video-T2V. This vulnerability stems from the use of pickle.loads to process request data in the /vae-api and /caption-api components. It may allow a remote attacker to execute arbitrary...

CVE-2025-57622

CVE-2025-57622 concerns Step-Video-T2V. Public descriptions identify a remote code execution vulnerability exploitable via the /vae-api and /caption-api endpoints, where untrusted request data is deserialized with pickle.loads(), enabling arbitrary code execution. The issue is described across mu...

CVE-2025-57622

An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loadsrequest.getdata component...

CVE-2025-57622

An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loadsrequest.getdata component...

EUVD-2025-208231

An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loadsrequest.getdata component...

CVE-2025-47383

CVE-2025-47383 describes a weak configuration that may cause a cryptographic issue when a VoWiFi call is triggered from UE. Connected records repeat the description and list a CVSS v3.1 base score of 7.2 (HIGH) with NETWORK attack vector, low attack complexity, and high impact on confidentiality,...

CVE-2025-47383 Missing Cryptographic Step in Data Modem

Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE...

TraceGuard: Process-Guided Firewall against Reasoning Backdoors in Large Language Models

The deployment of Large Reasoning Models LRMs in high-stakes decision-making pipelines has introduced a novel and opaque attack surface: reasoning backdoors. In these attacks, the model's intermediate Chain-of-Thought CoT is manipulated to provide a linguistically plausible but logically fallacio...

Missing Critical Step in Authentication

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Critical Step in Authentication due to insufficient validation of the authentication Level of Assuran...

PT-2026-21901

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description A time-of-create-to-time-of-use TOCTOU issue allows re-deletion of recently deleted and recreated data sources without authorization. The attack requires specific conditions: admin access to...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: hydra, ory-kratos, rekor, minio, rke2-runtime, step, apko, grafana-alloy-fips, sftpgo-plugin-eventstore, fulcio-fips, sqlexporter, amass, crossplane-provider-sql-fips, flux-kustomize-controller, juicefs, aactl, step-ca-fips, kyverno-fips, grafana-alloy, apko-fips,...