CVE-2025-9556

CVE-2025-9556 affects Langchaingo through the gonja-based prompt parsing that supports jinja2 syntax. The include/extends features in gonja 1.5.3 allow reading files, enabling server-side template injection (e.g., reading /etc/passwd). Affected details and remediation are supported by multiple so...

CVE-2025-9556 CVE-2025-9556

Langchaingo supports the use of jinja2 syntax when parsing prompts, which is in turn parsed using the gonja library v1.5.3. Gonja supports include and extends syntax to read files, which leads to a server side template injection vulnerability within langchaingo, allowing an attacker to insert a...

Langchaingo supports jinja2 and gonja for syntax parsing, allowing for arbitrary file read

Overview LangChainGo, the Go implementation of LangChain, a large language model LLM application building framework, has been discovered to contain an arbitrary file read vulnerability. The vulnerability, tracked as CVE-2025-9556, allows for arbitrary file read through the Gonja template engine...

PT-2025-37319

Name of the Vulnerable Software and Affected Versions: langchaingo affected versions not specified Description: langchaingo utilizes the gonja library version 1.5.3 to parse prompts that support jinja2 syntax. The gonja library’s support for include and extend syntax, which allows reading files,...

Linux Distros Unpatched Vulnerability : CVE-2016-2449

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - services/camera/libcameraservice/device3/Camera3Device.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before...

Linux Distros Unpatched Vulnerability : CVE-2022-0323

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Special Elements Used in a Template Engine in Packagist mustache/mustache prior to 2.14.1. CVE-2022-0323 Note that Nessus relies on t...

Linux Distros Unpatched Vulnerability : CVE-2020-18184

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In PluxXml V5.7,the theme edit function /PluXml/core/admin/parametresedittpl.php allows remote attackers to execute arbitrary PHP code by placing this code into...

Linux Distros Unpatched Vulnerability : CVE-2022-39051

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Attacker might be able to execute malicious Perl code in the Template toolkit, by having the admin installing an unverified 3th party package CVE-2022-39051 Not...

EulerOS 2.0 SP12 : gnutls (EulerOS-SA-2025-2007)

According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A NULL pointer dereference flaw was found in the GnuTLS software in gnutlsfigurecommonciphersuite.CVE-2025-6395 A heap-buffer-overflow off-by-one...

Linux Distros Unpatched Vulnerability : CVE-2024-48138

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A remote code execution RCE vulnerability in the component /PluXml/core/admin/parametresedittpl.php of PluXml v5.8.16 and lower allows attackers to execute...

Linux Distros Unpatched Vulnerability : CVE-2022-21648

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has been found that a...

Linux Distros Unpatched Vulnerability : CVE-2022-3501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Article template contents with sensitive data could be accessed from agents without permissions. CVE-2022-3501 Note that Nessus relies on the presence of the...

Linux Distros Unpatched Vulnerability : CVE-2017-17898

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr ERP/CRM version 6.0.4 does not block direct requests to .tpl.php files, which allows remote attackers to obtain sensitive information. CVE-2017-17898...

GHSA-RF24-WG77-GQ7W listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover

Summary Cross-Site Request Forgery CSRF is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated. With a little help of social engineering such as sending a link via email or chat, an attacker may trick the users of a web...

USN-7742-1: GnuTLS vulnerabilities

It was discovered that GnuTLS incorrectly handled exporting Subject Alternative Name SAN entries containing an otherName. A remote attacker could use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LT...

USN-7742-1 gnutls28 vulnerabilities

It was discovered that GnuTLS incorrectly handled exporting Subject Alternative Name SAN entries containing an otherName. A remote attacker could use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LT...

BIT-JUPYTERLAB-2024-39700 Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action

JupyterLab extension template is a copier template for JupyterLab extensions. Repositories created using this template with test option include update-integration-tests.yml workflow which has an RCE vulnerability. Extension authors hosting their code on GitHub are urged to upgrade the template to...

CVE-2025-10066

A security vulnerability has been detected in itsourcecode POS Point of Sale System 1.0. The affected element is an unknown function of the file /inventory/main/vendors/datatables/unittesting/templates/dymanictable.php. Such manipulation of the argument scripts leads to cross site scripting. The...

CVE-2025-10065

A weakness has been identified in itsourcecode POS Point of Sale System 1.0. Impacted is an unknown function of the file /inventory/main/vendors/datatables/unittesting/templates/domdatath.php. This manipulation of the argument scripts causes cross site scripting. The attack is possible to be...

POS Point of Sale System /2512.php File Cross-Site Scripting Vulnerability

POS Point of Sale System is a pos point of sale system. POS Point of Sale System suffers from a cross-site scripting vulnerability that originates from the lack of effective filtering and escaping of user-supplied data in the scripts parameter of the...