GHSA-JQCP-XC3V-F446 fast-float2 has a segmentation fault due to lack of bound check

In this case, the "fastfloat2::common::AsciiStr::first" method within the "AsciiStr" struct uses the unsafe keyword to reading from memory without performing bounds checking. Specifically, it directly dereferences a pointer offset by "self.ptr". Because of the above reason, the method accesses...

PT-2025-5633 · Unknown · Fast-Float

Name of the Vulnerable Software and Affected Versions: fast-float affected versions not specified Description: The issue arises from the fast float::common::AsciiStr::first method within the AsciiStr struct, which uses the unsafe keyword to read from memory without performing bounds checking. It...

PT-2025-5638 · Crates.Io · Fast-Float2

Name of the Vulnerable Software and Affected Versions: No specific software or version is mentioned. Description: The issue arises from the fast float2::common::AsciiStr::first method within the AsciiStr struct, which uses the unsafe keyword to read from memory without performing bounds checking...

Prototype Pollution

Overview org.webjars.bower:redoc is an OpenAPI/Swagger-generated API Reference Documentation. Affected versions of this package are vulnerable to Prototype Pollution via the mergeObjects method in utils/helpers.ts due to improper user input sanitization. PoC js async = const lib = await...

Prototype Pollution

Overview org.webjars:redoc is an OpenAPI/Swagger-generated API Reference Documentation. Affected versions of this package are vulnerable to Prototype Pollution via the mergeObjects method in utils/helpers.ts due to improper user input sanitization. PoC js async = const lib = await import'redoc';...

CVE-2025-23045

Computer Vision Annotation Tool CVAT is an interactive video and image annotation tool for computer vision. An attacker with an account on an affected CVAT instance is able to run arbitrary code in the context of the Nuclio function container. This vulnerability affects CVAT deployments that run...

CVE-2025-23045

CVE-2025-23045 affects Computer Vision Annotation Tool (CVAT). An attacker with an account on an affected CVAT instance can execute arbitrary code in the Nuclio function container via serverless tracker functions (TransT and SiamMask); deployments with custom tracker functions may also be affecte...

CVE-2025-23045 CVAT allows remote code execution via tracker Nuclio functions

Computer Vision Annotation Tool CVAT is an interactive video and image annotation tool for computer vision. An attacker with an account on an affected CVAT instance is able to run arbitrary code in the context of the Nuclio function container. This vulnerability affects CVAT deployments that run...

PT-2025-4790 · Nuclio +1 · Nuclio +1

Name of the Vulnerable Software and Affected Versions: Computer Vision Annotation Tool CVAT versions prior to 2.26.0 Description: The issue allows an attacker with an account on an affected CVAT instance to run arbitrary code in the context of the Nuclio function container. This affects CVAT...

The vulnerability of the web interface for managing microprogramming software-based network storage devices STEALTHONE D220 and D340 allows a intruder to gain unauthorized access to protected information.

The vulnerability of the web interface for managing microprogramming software-based network storage devices STEALTHONE D220 and D340 is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow an attacker, operating remotely, to gain...

CVE-2024-40693

IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. Attackers can make use of this weakness and upload malicious executable files into the system, and it can be sent to victim for performing furth...

MAL-2025-524 Malicious code in lyft-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2c565f4f063903c396ce391a766b2f2e23376ee54056eed2f91fe4584c931069 The OpenSSF Package Analysis project identified 'lyft-auth' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

The vulnerability of the sub_422eb8 function in the Linksys E8450 Wi-Fi router’s microprogramming system allows a intruder to trigger a service failure.

The vulnerability of the sub422eb8 function in the Linksys E8450 Wi-Fi router’s microprogramming system is related to the copying of buffers without checking the size of the input data during the strncpy operation. Exploiting this vulnerability can allow an attacker to cause a service failure...

Amazon Linux 2023 : ansible-core, ansible-test (ALAS2023-2025-820)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-820 advisory. 2025-02-12: CVE-2024-11079 was removed from this advisory. 2025-02-12: The severity of this advisory has been changed from medium to low. Tenable has extracted the preceding description block directly...

WordPress plugin Magic the Gathering Card Tooltips 跨站脚本漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPres...

GHSA-VP47-9734-PRJW ASTEVAL Allows Malicious Tampering of Exposed AST Nodes Leads to Sandbox Escape

Summary If an attacker can control the input to the asteval library, they can bypass its safety restrictions and execute arbitrary Python code within the application's context. Details The vulnerability is rooted in how asteval performs attribute access verification. In particular, the onattribut...

CVE-2025-0619 Unsafe stored password recovery

Unsafe password recovery from configuration in M-Files Server before 25.1 allows a highly privileged user to recover external connector passwords...

CVE-2025-0619 Unsafe stored password recovery

Unsafe password recovery from configuration in M-Files Server before 25.1 allows a highly privileged user to recover external connector passwords...

PT-2025-5646 · Asteval · Asteval

Name of the Vulnerable Software and Affected Versions: asteval affected versions not specified Description: The issue arises from how asteval performs attribute access verification, specifically in the on attribute node handler. This handler prevents access to attributes that are either present i...

PT-2025-3985 · M Files · M-Files Server

Name of the Vulnerable Software and Affected Versions: M-Files Server versions prior to 25.1 Description: The issue allows a highly privileged user to recover external connector passwords due to unsafe password recovery from the configuration. Recommendations: For versions prior to 25.1, update t...