Symlink Attack

Overview n8n-core is a Core functionality of n8n Affected versions of this package are vulnerable to Symlink Attack via the Read/Write File node. An attacker can access restricted files by creating symbolic links that bypass directory restrictions. Remediation Upgrade n8n-core to version 1.106.0 ...

GHSA-P72G-PV48-7W9X Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF

Critical XXE in Apache Tika tika-parser-pdf-module in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to...

Information Exposure

Overview x402-express is a x402 Payment Protocol Affected versions of this package are vulnerable to Information Exposure where sensitive endpoints could be unintentionally discovered by unauthorized endpoints. Note: This vulnerability impacts builders working on resource servers. Remediation...

CVE-2025-54988 Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA

Critical XXE in Apache Tika tika-parser-pdf-module in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to...

PT-2025-33890 · Totvs · Totvs Portal Meu Rh

Name of the Vulnerable Software and Affected Versions: TOTVS Portal Meu RH versions up to 12.1.17 Description: A flaw has been identified in the Password Reset Handler component that may allow for an open redirect. Manipulation of the redirectUrl argument can lead to a redirect to an arbitrary UR...

Linux Distros Unpatched Vulnerability : CVE-2022-23516

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah = 2.2.0, 2.19.1 uses recursion...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the calendar implementation. An attacker can obtain access to other users' calendars and their names by sending crafted requests, which may enable further targeted attacks such as phishing. Remediation Upgrade...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the calendar implementation. An attacker can obtain access to other users' calendars and their names by sending crafted requests, which may enable further targeted attacks such as phishing. Remediation Upgrade...

Server-side Request Forgery (SSRF)

Overview johnbillion/wp-crontrol is a package that allows you to take control of the cron events on your WordPress website. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the wpremoterequest function. An attacker can send arbitrary HTTP requests from the...

CVE-2017-20199

A vulnerability was found in Buttercup buttercup-browser-extension up to 0.14.2. Affected by this vulnerability is an unknown functionality of the component Vault Handler. The manipulation results in improper access controls. The attack may be performed from a remote location. A high complexity...

Linux Distros Unpatched Vulnerability : CVE-2023-37464

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. The AES GCM decryption routine incorrectly uses the Tag length from...

Linux Distros Unpatched Vulnerability : CVE-2024-43363

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cacti is an open source performance and fault management framework. An admin user can create a device with a malicious hostname containing php code and repeat t...

Linux Distros Unpatched Vulnerability : CVE-2023-39358

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows...

CVE-2017-20199

A vulnerability was found in Buttercup buttercup-browser-extension up to 0.14.2. Affected by this vulnerability is an unknown functionality of the component Vault Handler. The manipulation results in improper access controls. The attack may be performed from a remote location. A high complexity...

PT-2025-33515 · Z2D · Z2D

Name of the Vulnerable Software and Affected Versions: z2d versions 0.7.0 Description: z2d is a pure Zig 2D graphics library. A new multi-sample anti-aliasing MSAA method introduced in version 0.7.0 uses a new buffering mechanism for storing coverage data. Incorrect bounding under certain...

CVE-2017-20199 Buttercup buttercup-browser-extension Vault access control

A vulnerability was found in Buttercup buttercup-browser-extension up to 0.14.2. Affected by this vulnerability is an unknown functionality of the component Vault Handler. The manipulation results in improper access controls. The attack may be performed from a remote location. A high complexity...

Symlink Attack

Overview github.com/hashicorp/go-getter is a Package for downloading things from a string URL using a variety of protocols. Affected versions of this package are vulnerable to Symlink Attack due to handling symbolic links in the specific subdirectories from a fetched source. An attacker can acces...

Linux Distros Unpatched Vulnerability : CVE-2025-6965

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead ...

[SECURITY] [DLA 4273-1] postgresql-13 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4273-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb August 14, 2025 https://wiki.debian.org/LTS -...

SQL Injection

Overview apache-superset is a modern, enterprise-ready business intelligence web application. Affected versions of this package are vulnerable to SQL Injection via the DISALLOWEDSQLFUNCTIONS parameter, which allows execution of blocked SQL functions. An attacker can access sensitive database...