QNAP Systems Hero和QNAP Systems QTS 参数注入漏洞

QNAP Systems Hero and QNAP Systems QTS are both products of China-based Weilian Technology QNAP Systems.QNAP Systems Hero is a NAS operating system for file management. The system retains the application ecosystem of QTS and integrates the more powerful 128-bit ZFS file system to provide...

NVIDIA Nemo Framework 代码问题漏洞

NVIDIA Nemo Framework is a framework for building and deploying generative AI models from NVIDIA. The NVIDIA NeMo Framework contains a security vulnerability that can be exploited by attackers to cause code execution, elevation of privilege, denial of service, and data tampering...

NVIDIA Resiliency Extension 竞争条件问题漏洞

NVIDIA Resiliency Extension is a Python package from NVIDIA. NVIDIA Resiliency Extension suffers from a Competitive Condition Issue vulnerability that stems from the presence of a competitive condition in the checkpoint kernel, which could lead to information disclosure, data tampering, denial of...

PT-2025-51759

NVIDIA NeMo Framework contains a vulnerability in model loading that could allow an attacker to exploit improper control mechanisms if a user loads a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, and...

PT-2025-51760

Name of the Vulnerable Software and Affected Versions NVIDIA Resiliency Extension for Linux affected versions not specified Description NVIDIA Resiliency Extension for Linux has an issue in its log aggregation process that allows for predictable log-file names. Exploitation of this issue could le...

WordPress FileBird – WordPress Media Library Folders & File Manager plugin <= 6.5.1 - Missing Authorization to Authenticated (Author+) Global Folders Tampering vulnerability

Missing Authorization to Authenticated Author+ Global Folders Tampering vulnerability discovered by type5afe in WordPress Plugin Filebird versions = 6.5.1...

CVE-2025-14708 Shiguangwu sgwbox N3 WIREDCFGGET http_eshell_server buffer overflow

A weakness has been identified in Shiguangwu sgwbox N3 2.0.25. Affected by this vulnerability is an unknown functionality of the file /usr/sbin/httpeshellserver of the component WIREDCFGGET Interface. Executing manipulation of the argument params can lead to buffer overflow. The attack may be...

Unity Linux 20.1070e Security Update: krb5 (UTSA-2025-991244)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991244 advisory. A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If...

NVIDIA NVTabular Deserialization Vulnerability

NVIDIA NVTabular is a component of a deep learning recommender system framework from NVIDIA, USA. A deserialization vulnerability exists in NVIDIA NVTabular, which arises from unsafe deserialization of serialized data received from users by the Workflow component and can be exploited by an attack...

NVIDIA Merlin Transformers4Rec Deserialization Vulnerability

NVIDIA Merlin Transformers4Rec is a software for building serialized and conversational recommender systems from NVIDIA. NVIDIA Merlin Transformers4Rec suffers from a deserialization vulnerability that originates from unsafe deserialization processing of serialized data submitted by a user when...

CVE-2025-54369

Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify...

CVE-2025-36747

ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the server. This may allow an attacker to replace legitimate files being deployed to devices with their own malicious versions, since the firmwar...

CVE-2025-36747

The CVE entry for CVE-2025-36747 describes ShineLan-X firmware containing FTP server credentials, enabling testers to establish an insecure FTP connection. This can allow an attacker to replace legitimate firmware-deployed files with malicious versions because firmware signature verification is n...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: aide (UTSA-2025-991233)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991233 advisory. AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE. An attacker can craft...

PT-2025-51097

ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the server. This may allow an attacker to replace legitimate files being deployed to devices with their own malicious versions, since the firmwar...

CVE-2025-66450

LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when a user posts a question, the iconURL parameter of the POST request can be modified by an attacker. The malicious code is then stored in the chat which can then be shared to other users. When sharing chats wit...

AzuraCast 安全漏洞

AzuraCast is a simple self-hosted webcast management suite from AzuraCast, Inc. A security vulnerability exists in AzuraCast version 0.23.1, which stems from the incorrect inclusion of an API endpoint for internal use only, which could lead to tampering with database contents...

EUVD-2025-202702

An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can use JavaScript to alter annotation content and subsequently clear the file's modification status via JavaScript interfaces. This circumvents digital signature verification b...

EulerOS 2.0 SP13 : aide (EulerOS-SA-2025-2513)

According to the versions of the aide package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE. An...

CVE-2025-55310

CVE-2025-55310 affects Foxit PDF Editor for Windows/macOS prior to 13.2 and 2025 before 2025.2. An attacker who can alter or replace the StartPage static HTML files can cause malicious content to load at startup, leading to information disclosure or unauthorized data access. Remediation: update t...