Improper Handling of Undefined Values

Overview Affected versions of this package are vulnerable to Improper Handling of Undefined Values in the torch.cummin component when compiling a model with Inductor. An attacker can cause the application to crash or become unresponsive by submitting a specially crafted model that triggers a name...

Reachable Assertion

Overview Affected versions of this package are vulnerable to Reachable Assertion via the nn.Fold function when used with inductor. An attacker can cause the application to terminate unexpectedly by triggering a buffer overflow error. Remediation Upgrade pytorch/pytorch to version 2.7.0-rc1 or...

PT-2025-39369

Name of the Vulnerable Software and Affected Versions Sistemas Pleno Gestão de Locação versions up to 2025.7.x Description A flaw exists that allows for authorization bypass through manipulation of the pes cpf argument. This issue impacts an unknown function within the file...

PT-2025-39464

Name of the Vulnerable Software and Affected Versions JeecgBoot versions through 3.8.2 Description A security issue exists in JeecgBoot that allows for improper authorization. This is related to a file at /sys/position/exportXls and an unknown function within it. The attack can be launched...

CVE-2025-57902

Cross-Site Request Forgery CSRF vulnerability in Md Taufiqur Rahman RIS Version Switcher - Downgrade or Upgrade WP Versions Easily ris-version-switcher allows Cross Site Request Forgery.This issue affects RIS Version Switcher - Downgrade or Upgrade WP Versions Easily: from n/a through = 1.0...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale and the Cloudkit are now included (CVE-2025-30204)

Summary The following vulnerabilities that can affect IBM Storage Scale and the Cloudkit and could provide weaker than expected security are now fixed CVE-2025-30204. Vulnerability Details CVEID:CVE-2025-30204 DESCRIPTION: golang-jwt is a Go implementation of JSON Web Tokens. Starting in version...

Unquoted Search Path or Element

Overview Affected versions of this package are vulnerable to Unquoted Search Path or Element via the SunshineService process. An attacker can execute arbitrary code with SYSTEM privileges by placing a malicious executable in a directory path containing spaces, which is interpreted incorrectly by...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to improper parsing of the HTTP trailer section in the parse function. An attacker can bypass security controls, launch targeted attacks against users, or poison web caches by crafting specially formed HTTP...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to improper parsing of the HTTP trailer section in the parse function. An attacker can bypass security controls, launch targeted attacks against users, or poison web caches by crafting specially formed HTTP...

Uncontrolled Search Path Element

Overview @salesforce/cli is a The Salesforce CLI Affected versions of this package are vulnerable to Uncontrolled Search Path Element via the Replace Trusted Executable feature. An attacker can execute arbitrary code by placing a malicious executable in a directory that is searched before the...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the audit events that record password reminder answers. An attacker can access sensitive user information by retrieving password reminder answers from audit logs. Remediation Upgrade...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free via improper handling of caches. An attacker can obtain unauthorized access to sensor information by tricking a user into visiting a malicious website. This is only exploitable if the system is configured with certain...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free via improper handling of caches. An attacker can obtain unauthorized access to sensor information by tricking a user into visiting a malicious website. This is only exploitable if the system is configured with certain...

Out-of-Bounds

Overview Affected versions of this package are vulnerable to Out-of-Bounds due to improper memory handling. An attacker can cause a process crash or potentially execute arbitrary code by tricking a user into processing or loading malicious web content. Note: This is only exploitable if packages...

Stack-based Buffer Overflow

Overview codechecker is an analyzer tooling, defect database and viewer extension Affected versions of this package are vulnerable to Stack-based Buffer Overflow via the strcpy function in the internal ldlogger library. An attacker can execute arbitrary code or cause a crash by supplying crafted...

Command Injection

Overview git-commiters is a Statistical summary of various infomation about git commiter. Affected versions of this package are vulnerable to Command Injection via the gitCommiters API which allows specifying options such as cwd for current working directory and revisionRange as a revision pointe...

Double Free

Overview Affected versions of this package are vulnerable to Double Free via the dltlinuxsll2cleanup function. An attacker can cause memory corruption and application crash by supplying a specially crafted pcap file to the binary. Remediation Upgrade appneta/tcpreplay to version 4.5.2 or higher...

CVE-2025-10777 JSC R7 R7-Office Document Server downloadas path traversal

A flaw has been found in JSC R7 R7-Office Document Server up to 20250820. Impacted is an unknown function of the file /downloadas/. Executing manipulation of the argument cmd can lead to path traversal. The attack can be launched remotely. Upgrading to version 2025.3.1.923 is recommended to addre...

OESA-2025-2296 apache-mime4j security update

Java stream based MIME message parser. Security Fixes: Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue affects Apache James MIME4J version 0.8.8 and prior versions. We recommend users to...

OESA-2025-2305 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...