EUVD-2023-25511

Malicious code in bioql PyPI...

EUVD-2023-44728

Malicious code in bioql PyPI...

GHSA-466C-PFVV-V83G wrflib has a soundness issue and is unmaintained

All functions under wrflib::byteextract are simply wrapper of unsafe pointer offset and lacks sufficient checks to it pointer and offset parameter. wrflib is unmaintained...

wrflib has a soundness issue and is unmaintained

All functions under wrflib::byteextract are simply wrapper of unsafe pointer offset and lacks sufficient checks to it pointer and offset parameter. wrflib is unmaintained...

CVE-2025-60450

A stored Cross-Site Scripting XSS vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and sanitization of SVG file uploads in the app\system\include\module\editor\Uploader.class.php component. This security flaw allows attackers to...

CVE-2025-61584

serverless-dns is a RethinkDNS resolver that deploys to Cloudflare Workers, Deno Deploy, Fastly, and Fly.io. Versions through abd including 0.1.30 have a vulnerability where the pr.yml GitHub Action interpolates in an unsafe manner untrusted input, specifically the...

soundness issue and unmaintained

All functions under wrflib::byteextract are simply wrapper of unsafe pointer offset and lacks sufficient checks to it pointer and offset parameter. wrflib is unmaintained...

RUSTSEC-2025-0072 soundness issue and unmaintained

All functions under wrflib::byteextract are simply wrapper of unsafe pointer offset and lacks sufficient checks to it pointer and offset parameter. wrflib is unmaintained...

CVE-2025-39923

In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom: bamdma: Fix DT error handling for num-channels/ees When we don't have a clock specified in the device tree, we have no way to ensure the BAM is on. This is often the case for remotely-controlled or remotely-power...

Exploit for Cross-site Scripting in Snipeitapp Snipe-It

PoC for CVE-2025-59712 and CVE-2025-59713 This PoC provides a...

Rejected reason: This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.

...

Jenkins JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links in an unsafe manner, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

...

CVE-2025-9697 Ajax WooSearch <= 1.0.0 - Unauthenticated SQL Injection

The Ajax WooSearch WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2025-11221 Remote Code Execution in GTONE ChangeFlow

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal', Unrestricted Upload of File with Dangerous Type vulnerability in GTONE ChangeFlow allows Path Traversal, Accessing Functionality Not Properly Constrained by ACLs.This issue affects ChangeFlow: from All versions through...

CVE-2025-56154

htmly v3.0.8 is vulnerable to Cross Site Scripting XSS in the /author/:name endpoint of the affected application. The name parameter is not properly sanitized before being reflected in the HTML response, allowing attackers to inject arbitrary JavaScript payloads...

The vulnerability of the libcups printing library allows a attacker to cause a service failure.

The vulnerability of the libcups printing server library is related to the dereferencing of the null pointer due to unsafe deserialization and checking of printer attributes. Exploiting this vulnerability could allow an attacker to cause service failures remotely...

MarkAny SafePC Enterprise 安全漏洞

MarkAny SafePC Enterprise is an endpoint data leakage prevention software from the Korean company MarkAny. A security vulnerability exists in MarkAny SafePC Enterprise versions prior to V7.0.1 and V5.. versions contain a security vulnerability that stems from a path traversal vulnerability that...

An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.

...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection in the QuerySet.annotate, QuerySet.alias, QuerySet.aggregate, and QuerySet.extra methods when a specially crafted dictionary is passed using dictionary expansion as kwargs, leading to unsafe column aliases on MySQL and...

Security Bulletin: due to the use of 10x UI, IBM Transformation Extender Advanced is vulnerable to unsafe deserialization in Java

Summary IBM Transformation Extender Advanced also known as IBM Standards Processing Engine has a vulnerability that could allow attackers to perform remote code execution. Please upgrade to one of the fixed versions in this bulletin. Vulnerability Details CVEID:CVE-2022-42441 DESCRIPTION: IBM...