CVE-2025-14926

Hugging Face Transformers SEW convert_config vulnerability (CVE-2025-14926) affects the Transformers library. The flaw is in convert_config: it does not validate a user-supplied string before using it to execute Python code, enabling arbitrary code execution in the attacker’s context when a malic...

NSF Unidata NetCDF-C security vulnerability

NSF Unidata NetCDF-C is a tool for processing NetCDF files from NSF Unidata, USA. A security vulnerability exists in NSF Unidata NetCDF-C that stems from a lack of validation of the length of user-supplied data when parsing dimension names, which could lead to a heap buffer overflow and remote co...

Soda PDF Desktop Buffer Error Vulnerability

Soda PDF Desktop is a full-featured PDF editing software from Soda Canada. Soda PDF Desktop suffers from a buffer error vulnerability that stems from a lack of validation of user-supplied data when parsing PDF files, which could lead to out-of-bounds writes and remote code execution...

PT-2025-52877

CVE-2025-68653 - Cisco Router Unvalidated User Input CVE ID : CVE-2025-68653 Published : Dec. 23, 2025, 4:15 a.m. | 2 hours, 43 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Soda PDF Desktop Buffer Error Vulnerability

Soda PDF Desktop is a full-featured PDF editing software from Soda Canada. Soda PDF Desktop suffers from a buffer error vulnerability that stems from a lack of validation of user-supplied data when parsing PDF files, which could lead to out-of-bounds reads and information disclosure...

EUVD-2025-204260

A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user with report privileges can define a malicious report containing a JavaScript payload, or a victim can be socially engineered to import a...

WODESYS WD-R608U: Operating System Command Injection Vulnerability

WODESYS WD-R608U is a wireless router from China Xinyang WODESYS. The WODESYS WD-R608U suffers from an operating system command injection vulnerability that stems from a lack of validation of the langGet parameter of the adm.cgi endpoint, which could lead to a malicious attacker executing system...

(0Day) Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must convert a malicious checkpoint. The specific flaw exists within the convertconfig functio...

Weblate Cross-Site Request Forgery Vulnerability

Weblate is a Copyleft open source web-based free software continuous localization system. A cross-site request forgery vulnerability exists in Weblate versions prior to 5.15, which stems from an unvalidated or uncleaned repository URL field in the Create Component function, and could lead to...

EUVD-2025-203212

The The Shortcode Ajax plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2025-66451

LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when creating prompts, JSON requests are sent to define and modify the prompts via PATCH endpoint for prompt groups /api/prompts/groups/:groupId. However, the request bodies are not sufficiently validated for prop...

WordPress Accordion Slider PRO plugin SQL Injection Vulnerability

WordPress Accordion Slider PRO plugin is a responsive, touch-enabled slider plugin for WordPress that allows users to create professional and elegant slider effects. The WordPress Accordion Slider PRO plugin suffers from an SQL injection vulnerability that stems from the application's lack of...

WordPress ArtPlacer Widget plugin SQL Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A SQL injection vulnerability exists in the WordPress ArtPlacer Widget plugin that stems from the application's lack of validation of externally entered SQL statements. No...

CVE-2025-66451

LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when creating prompts, JSON requests are sent to define and modify the prompts via PATCH endpoint for prompt groups /api/prompts/groups/:groupId. However, the request bodies are not sufficiently validated for prop...

Ruijie M18 security vulnerabilities

Ruijie M18 is a WiFi router from China Ruijie Ruijie. A security vulnerability exists in Ruijie M18 EW3.01B11P226M1810223116, which originates from an unvalidated input to the moduleget function in the file /usr/local/lua/devsta/networkConnect.lua, which could lead to an OS command injection atta...

PT-2025-50772

Name of the Vulnerable Software and Affected Versions LibreChat versions 0.8.0 and below Description LibreChat, a ChatGPT clone, has an issue where input validation is insufficient when creating prompts. JSON requests sent to the /api/prompts/groups/:groupId endpoint via the PATCH method are not...

Ruijie RG-BCR security vulnerabilities

Ruijie RG-BCR is a series of cloud routers from China Ruijie Ruijie. A security vulnerability exists in the Ruijie RG-BCR RG-BCR600W version, which originates from unvalidated input to the restartmodules function in the file /usr/lib/lua/luci/controller/admin/common.lua, which could lead to an OS...

Ruijie X30 PRO security vulnerabilities

Ruijie X30 PRO is a home wireless router from China Ruijie Ruijie. A security vulnerability exists in the Ruijie X30 PRO V1 X30-PRO-V109241521 version, which originates from an unvalidated input to the moduleget function in the file /usr/local/lua/devsta/networkConnect.lua, which could lead to an...

Ruijie X30 PRO security vulnerabilities

Ruijie X30 PRO is a home wireless router from China Ruijie Ruijie. A security vulnerability exists in the Ruijie X30 PRO X30-PRO-V109241521 version, which originates from an unvalidated input to the setWisp function in the file /usr/lib/lua/luci/modules/wireless.lua, which could lead to an OS...

PT-2025-51119

CVE-2025-67687 - Apache Apache HTTP Server Unvalidated User Input CVE ID : CVE-2025-67687 Published : Dec. 11, 2025, 4:15 a.m. | 1 hour, 3 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and...