CVE-2025-3193

Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the merge function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the "extreme edge-case" that the resulting error is...

CVE-2025-3193

The CVE-2025-3193 entry concerns algoliasearch-helper versions 2.0.0-rc1 through 3.11.2 (and earlier) with a Prototype Pollution in the _merge() function of merge.js. The underlying issue allows modification of constructor.prototype and, in an extreme edge-case where the resulting error is caught...

CVE-2025-57347

A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConflict function, which fails to properly sanitize user-supplied input during property assignment operations. This flaw allows attackers to exploit prototype pollution...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via the removeAttributeNS function. An attacker can manipulate the prototype chain of JavaScript objects, potentially causing a denial-of-service attack by supplying malicious input that targets the proto property...

Arbitrary Code Execution

ImageMagick is vulnerable to Arbitrary Code Execution. The vulnerability is due to format string vulnerability due to user input being passed directly to FormatLocaleString without proper sanitization, allowing attackers to overwrite arbitrary memory and potentially achieve remote code execution...

PT-2025-39524

CVE-2025-59929 - Apache HTTP Server Unvalidated User Input CVE ID : CVE-2025-59929 Published : Sept. 24, 2025, 3:15 a.m. | 4 hours, 7 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Cross-site Scripting (XSS)

Overview mailgen is a Generates clean, responsive HTML e-mails for sending transactional mail. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the generatePlaintext function. An attacker can inject arbitrary HTML content into plaintext emails by supplying crafted...

The vulnerability of the CI/CD application integration and delivery system provided by JetBrains TeamCity lies in the improper validation of user-input data against a list of allowed values. This allows attackers to disclose sensitive information that should be protected.

The vulnerability of the Continuous Integration and Deployment Application Delivery system CI/CD of JetBrains TeamCity is related to improper validation of the data entered by users against a list of allowed values. Exploiting this vulnerability can allow an attacker to disclose protected...

Cross-site Scripting (XSS)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper input validation in the process responsible for handling user-supplied data. An attacker can execute arbitrary scripts in the context o...

WordPress Social Media Shortcodes plugin cross-site scripting vulnerability

WordPress Social Media Shortcodes plugin is a shortcode Shortcodes to quickly embed social media features into the WordPress website plugin, mainly used to simplify the implementation of social media sharing, login, comments and other features. A cross-site scripting vulnerability exists in the...

SUSE CVE-2022-50399

In the Linux kernel, the following vulnerability has been resolved: media: atomisp: prevent integer overflow in shcsssetblackframe The "height" and "width" values come from the user so the "height width" multiplication can overflow...

CVE-2022-50399

In the Linux kernel, the following vulnerability has been resolved: media: atomisp: prevent integer overflow in shcsssetblackframe The "height" and "width" values come from the user so the "height width" multiplication can overflow...

CVE-2022-50399

In the Linux kernel, the following vulnerability has been resolved: media: atomisp: prevent integer overflow in shcsssetblackframe The "height" and "width" values come from the user so the "height width" multiplication can overflow...

UBUNTU-CVE-2022-50399

In the Linux kernel, the following vulnerability has been resolved: media: atomisp: prevent integer overflow in shcsssetblackframe The "height" and "width" values come from the user so the "height width" multiplication can overflow...

CVE-2022-50399

In the Linux kernel, the following vulnerability has been resolved: media: atomisp: prevent integer overflow in shcsssetblackframe The "height" and "width" values come from the user so the "height width" multiplication can overflow...

CVE-2022-50399 media: atomisp: prevent integer overflow in sh_css_set_black_frame()

In the Linux kernel, the following vulnerability has been resolved: media: atomisp: prevent integer overflow in shcsssetblackframe The "height" and "width" values come from the user so the "height width" multiplication can overflow...

CVE-2022-50394

CVE-2022-50394 affects the Linux kernel i2c subsystem (specifically the ismt ioctl path in the ismt_access() function). The vulnerability arises when the driver does not validate user-supplied data, allowing an oversized data->block[0] to trigger an out-of-bounds read, as demonstrated by the k...

CVE-2025-9083

The Ninja Forms WordPress plugin before version 3.11.1 is vulnerable to PHP Object Injection due to the unserialization of user-supplied data via form fields. This flaw allows unauthenticated users to potentially execute malicious payloads if a suitable gadget is present on the blog. To mitigate ...

CVE-2025-35431 CISA Thorium LDAP injection

CISA Thorium does not escape user controlled strings used in LDAP queries. An authenticated remote attacker can modify LDAP authorization data such as group memberships. Fixed in 1.1.1...

CVE-2025-35431

CVE-2025-35431 affects CISA Thorium: LDAP injection arises from not escaping user-controlled LDAP query strings. An authenticated remote attacker could modify LDAP authorization data (e.g., group memberships). Root cause is lack of escaping in LDAP queries; impact includes potential unauthorized ...