PT-2025-33302 · Flaskblog · Flaskblog

Name of the Vulnerable Software and Affected Versions: flaskBlog versions prior to 2.8.1 Description: flaskBlog is a blog application built with Flask. Improper sanitization of the postContent parameter when submitting POST requests to the /createpost API endpoint leads to arbitrary JavaScript...

EulerOS 2.0 SP11 : emacs (EulerOS-SA-2025-1923)

According to the versions of the emacs package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point for code completion on untrusted Emacs Lisp source...

PT-2025-34580 · Crates.Io · Scratchpad

The get and set methods of the public trait scratchpad::Tracking interact with unsafe code regions in the crate, and they influence the computation of addresses returned as raw pointers. However, the trait itself is not marked as unsafe, meaning users may provide custom implementations under the...

PT-2025-33298 · Rockwell Automation · Studio 5000 Logix Designer

Name of the Vulnerable Software and Affected Versions: Studio 5000 Logix Designer affected versions not specified Description: A security issue exists in Studio 5000 Logix Designer related to unsafe handling of environment variables. When a specified path does not contain a valid file, the softwa...

CVE-2012-10058

RabidHamster R4 v1.25 contains a stack-based buffer overflow vulnerability due to unsafe use of sprintf when logging malformed HTTP requests. A remote attacker can exploit this flaw by sending a specially crafted URI, resulting in arbitrary code execution under the context of the web server proce...

CVE-2011-10019

Spreecommerce before 0.60.2 is vulnerable to remote command execution via the search[send][] input, which is dynamically invoked using Ruby’s send method and not properly sanitized. This allows an unauthenticated attacker to execute arbitrary shell commands on the server. Affected component: sear...

CVE-2025-2180

An unsafe deserialization vulnerability in Palo Alto Networks Checkov by Prisma® Cloud allows an authenticated user to execute arbitrary code as a non administrative user by scanning a malicious terraform file when using Checkov in Prisma® Cloud. This issue impacts Checkov 3.0 versions earlier th...

CVE-2025-2180 Checkov by Prisma Cloud: Unsafe Deserialization of Terraform Files Allows Code Execution

An unsafe deserialization vulnerability in Palo Alto Networks Checkov by Prisma® Cloud allows an authenticated user to execute arbitrary code as a non administrative user by scanning a malicious terraform file when using Checkov in Prisma® Cloud. This issue impacts Checkov 3.0 versions earlier th...

CVE-2025-2180 Checkov by Prisma Cloud: Unsafe Deserialization of Terraform Files Allows Code Execution

An unsafe deserialization vulnerability in Palo Alto Networks Checkov by Prisma® Cloud allows an authenticated user to execute arbitrary code as a non administrative user by scanning a malicious terraform file when using Checkov in Prisma® Cloud. This issue impacts Checkov 3.0 versions earlier th...

CVE-2025-2180

The CVE-2025-2180 entry describes an unsafe deserialization vulnerability in Palo Alto Networks Checkov by Prisma Cloud. Affected product: Checkov (in Prisma Cloud) versions prior to 3.2.415. Vulnerable component: the deserialization process when scanning Terraform files. Root cause: unsafe deser...

USN-6885-6: Apache HTTP Server regression

USN-6885-1 fixed vulnerabilities in Apache. The patch for CVE-2024-38474 was incomplete and caused a regression. This update provides the fix for this issue. Original advisory details: Orange Tsai discovered that the Apache HTTP Server modrewrite module incorrectly handled certain substitutions. ...

USN-6885-6 apache2 regression

USN-6885-1 fixed vulnerabilities in Apache. The patch for CVE-2024-38474 was incomplete and caused a regression. This update provides the fix for this issue. Original advisory details: Orange Tsai discovered that the Apache HTTP Server modrewrite module incorrectly handled certain substitutions. ...

CVE-2025-55345 Unsafe symlink following in restricted workspace-write sandbox leads to RCE

Using Codex CLI in workspace-write mode inside a malicious context repo, directory, etc could lead to arbitrary file overwrite and potentially remote code execution due to symlinks being followed outside the allowed current working directory...

CVE-2025-55345 Unsafe symlink following in restricted workspace-write sandbox leads to RCE

Using Codex CLI in workspace-write mode inside a malicious context repo, directory, etc could lead to arbitrary file overwrite and potentially remote code execution due to symlinks being followed outside the allowed current working directory...

PT-2025-32990 · Unknown · Cherry-Studio

Name of the Vulnerable Software and Affected Versions: Cherry Studio version 1.5.1 Description: Cherry Studio is a desktop client that supports multiple LLM providers. A remote code execution RCE vulnerability exists when connecting to streamableHttp MCP servers. The issue stems from the server’s...

PT-2025-32997

Name of the Vulnerable Software and Affected Versions: ImageMagick versions prior to 6.9.13-27 ImageMagick versions prior to 7.1.2-1 Description: ImageMagick is free and open-source software used for editing and manipulating digital images. The magnified size calculations in the ReadOneMNGImage...

PT-2025-33093 · Unknown · Rabidhamster

Name of the Vulnerable Software and Affected Versions: RabidHamster versions 1.25 Description: RabidHamster R4 version 1.25 contains a stack-based buffer overflow due to the unsafe use of sprintf when logging malformed HTTP requests. A remote attacker can exploit this issue by sending a specially...

Spree Commerce 安全漏洞

Spree Commerce is an e-commerce platform from Spree Open Source. A security vulnerability exists in Spree Commerce versions prior to 0.60.2 that stems from the search function not cleaning up inputs, which could lead to remote command execution...

Extending the OWASP Multi-Agentic System Threat Modeling Guide: Insights from Multi-Agent Security Research

We propose an extension to the OWASP Multi-Agentic System MAS Threat Modeling Guide, translating recent anticipatory research in multi-agent security MASEC into practical guidance for addressing challenges unique to large language model LLM-driven multi-agent architectures. Although OWASP's...

PT-2025-33020 · Palo Alto Networks · Prisma Cloud +1

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks Checkov by Prisma® Cloud versions prior to 3.2.415 Description: An unsafe deserialization issue in Palo Alto Networks Checkov by Prisma® Cloud allows an authenticated user to execute arbitrary code as a non-administrative...