23740 matches found
SUSE SLED15: libpython3_6m1_0 / libpython3_6m1_0-32bit / python3 / python3-base / etc (SUSE-SU-2026:0027-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0027-1 advisory. - CVE-2025-12084: cpython: Fixed quadratic algorithm in xml.dom.minidom leading to denial of...
CVE-2025-69227
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled -O or PYTHONOPTIMIZE=1, and the...
ALSA-2026:0123 Moderate: python3.12 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
CVE-2025-69228
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an AIOHTTP server's memory fills up uncontrollably during processing. If an application includes a handler that uses the Request.post method, ...
CVE-2025-68428
creationtimestamp| type| source ---|---|--- 2026-01-05 23:05:27+00:00| seen| Telegram/DM3pgu0RzgLvzG-bb0EsBJeE-HNavxIR4FBWximsYdDyCg 2026-01-06 00:12:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbpo5ok4pf2y 2026-01-06 06:36:57+00:00| seen|...
CVE-2025-68456 Unauthenticated Craft CMS users can trigger a database backup
Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update ...
EUVD-2026-0825
Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update ...
CVE-2026-0625
creationtimestamp| type| source ---|---|--- 2026-01-05 21:28:35+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115844613054542200 2026-01-05 23:05:33+00:00| published-proof-of-concept| Telegram/SaQdu2HuKivKnxzQDHW0crSXnl1eIl3nAV9Cs1OYgaU4ueA 2026-01-05 23:05:39+00:00| seen|...
CVE-2025-64420
creationtimestamp| type| source ---|---|--- 2026-01-05 20:25:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbpbhxuib22a 2026-01-05 20:25:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbpbiidogk2f 2026-01-05 20:49:13+00:00| seen|...
CVE-2025-64419
creationtimestamp| type| source ---|---|--- 2026-01-05 20:25:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbpbhqkwvq2t 2026-01-05 20:25:34+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbpbiaulia2p 2026-01-05 20:52:13+00:00| seen|...
EUVD-2025-206245
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434, low privileged users are able to see the private key of the root user on the Coolify instance. This allows them to ssh to the server and...
CVE-2025-55204
The CVE-2025-55204 entry concerns the Muffon desktop music client. Affected versions are prior to 2.3.0, where a one-click Remote Code Execution (RCE) vulnerability exists via a specially crafted muffon:// link. When a user visits a page or clicks the link, Muffon’s custom URL handler is triggere...
CVE-2025-15029
creationtimestamp| type| source ---|---|--- 2026-01-05 16:00:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbosowtwab2m 2026-01-05 16:01:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbospmfbss2u 2026-01-05 16:05:40+00:00| seen|...
SUSE-SU-2026:0023-1 Security update for erlang26
This update for erlang26 fixes the following issues: - CVE-2025-48040: Excessive resource consumption bsc1249472 - CVE-2025-48039: Excessive use of system resources bsc1249469 - CVE-2025-48038: Excessive use of system resources bsc1249470...
CVE-2025-30633 WordPress Amazon Native Shopping Recommendations Plugin <= 1.3 - SQL Injection Vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AA-Team Amazon Native Shopping Recommendations allows SQL Injection.This issue affects Amazon Native Shopping Recommendations: from n/a through 1.3...
CVE-2025-15022
CVE-2025-15022 describes an XSS vulnerability in Vaadin where caption HTML was not sanitized. Affected are Vaadin Framework 7 (7.0.0–7.7.49) and 8 (8.0.0–8.29.1), as well as Vaadin 23.1.0–23.6.5, Vaadin 24.0.0–24.8.13, and Vaadin 24.9.0–24.9.6. Fixed versions sanitize captions by default and, for...
EUVD-2026-0820
Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting XSS if caption content is derived from user input. In Vaadin Framework 7 and 8, the Action class is a general-purpose class that may be used by multiple components. The fixed version...
Security Bulletin: IBM Maximo Application Suite uses java 17.0.13,github.com/go-viper/mapstructure/v2 v2.2.1 and github.com/docker/docker v27.3.1 which is vulnerable to GHSA-2464-8j7c-4cjm,CVE-2025-21502 and CVE-2025-54410
Summary IBM Maximo Application Suite uses java 17.0.13,github.com/go-viper/mapstructure/v2 v2.2.1 and github.com/docker/docker v27.3.1 which is vulnerable to GHSA-2464-8j7c-4cjm,CVE-2025-21502 and CVE-2025-54410. This bulletin contains information regarding the vulnerability and its fixture...
Coolify 安全漏洞
Coolify is an open source and self-hosted Heroku/Netlify/Vercel replacement from coolLabs Open Source. A security vulnerability exists in Coolify v4.0.0-beta.434 and earlier versions, which stems from a low-privileged user being able to use an invitation link sent to an administrator, potentially...