DokuWiki 安全漏洞

DokuWiki is an easy-to-use and versatile open source Wiki software from DokuWiki Open Source. A security vulnerability exists in DokuWiki version 2025-05-14a, which stems from an unvalidated q parameter that could lead to a cross-site scripting attack...

YoSmart YoLink Application 安全漏洞

YoSmart YoLink Application is a smart home management application from YoSmart USA. A security vulnerability exists in YoSmart YoLink Application version 2025-10-02 and earlier, which stems from a session token lifecycle that is too long...

YoSmart YoLink MQTT broker 安全漏洞

YoSmart YoLink MQTT broker is a messaging proxy server from YoSmart USA. A security vulnerability exists in YoSmart YoLink MQTT broker version 2025-10-02 and earlier, which stems from insufficient authorization controls and could lead to cross-account attacks...

EUVD-2025-27220

Malicious code in bioql PyPI...

EUVD-2025-10521

Malicious code in bioql PyPI...

Quadient DS-700 iQ 竞争条件问题漏洞

The Quadient DS-700 iQ is an automated envelope sealer device from Quadient, France. A Competitive Condition Issue vulnerability exists in the Quadient DS-700 iQ version 2025-09-30 and earlier, which originates from a competitive condition that exists when clicking the Question Mark button, the...

CVE-2025-10397

A vulnerability was identified in Magicblack MacCMS 2025.1000.4050. This affects an unknown part of the component API Handler. The manipulation of the argument cjurl leads to server-side request forgery. The attack can be initiated remotely. The exploit is publicly available and might be used...

CVE-2025-10199

A local privilege escalation vulnerability exists in Sunshine for Windows version v2025.122.141614 and likely prior versions due to an unquoted service path...

CVE-2025-10198 LizardBytes Sunshine for Windows contains a DLL search-order hijacking vulnerability

Sunshine for Windows, version v2025.122.141614, contains a DLL search-order hijacking vulnerability, allowing attackers to insert a malicious DLL in user-writeable PATH directories...

Liferay Portal和Liferay DXP 安全漏洞

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...

Sunshine 安全漏洞

Sunshine is an open source self-service game streaming host for Moonlight by LizardByte. A security vulnerability exists in Sunshine version v2025.122.141614, which stems from DLL search order hijacking and could lead to the insertion of a malicious DLL...

Important Photon OS Security Update - PHSA-2025-4.0-0865

Updates of 'libsoup' packages of Photon OS have been released...

CVE-2025-43747

A server-side request forgery SSRF vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due to insecure domain validation on analytics.cloud.domain.allowed, allowing an attacker to perform requests by change the domain and bypassing the validation method, this insecure validation i...

PT-2025-33648 · Liferay · Liferay Portal 7.4.3.132 +2

Name of the Vulnerable Software and Affected Versions: Liferay Portal version 7.4.3.132 Liferay DXP versions 2025.Q1.0 through 2025.Q1.7 Description: A reflected cross-site scripting XSS vulnerability allows a remote authenticated attacker to inject JavaScript code via the content page’s name...

Paramount Macrium Reflect 安全漏洞

Paramount Macrium Reflect is an image-based backup and recovery software from Paramount UK. A security vulnerability exists in Paramount Macrium Reflect version 2025-06-26 and earlier, which stems from insufficient authentication and could lead to the execution of arbitrary code with administrato...

CVE-2025-7848

A memory corruption vulnerability due to improper input validation in lvpict.cpp exists in NI LabVIEW that may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior...

AIBOX 跨站脚本漏洞

AIBOX is an AI authoring platform from the Chinese company AIBOX. A security vulnerability exists in AIBOX versions 2025-05-27 and earlier, which stems from a reflective cross-site scripting attack that could lead to account hijacking...

CVE-2025-53909 mailcow: dockerized vulnerable to SSTI in Quota and Quarantine Notification Template

mailcow: dockerized is an open source groupware/email suite based on docker. A Server-Side Template Injection SSTI vulnerability exists in versions prior to 2025-07 in the notification template system used by mailcow for sending quota and quarantine alerts. The template rendering engine allows...

CVE-2025-53909

CVE-2025-53909 affects mailcow: dockerized. A Server-Side Template Injection (SSTI) exists in the quota/quarantine notification template rendering system, allowing template expressions to be abused to execute code in certain contexts. The issue requires admin-level access to configure templates, ...

Netwrix Directory Manager 安全漏洞

Netwrix Directory Manager is a group and user management software from Netwrix, Inc. A security vulnerability exists in Netwrix Directory Manager version 2025-05-01 and earlier, which stems from vulnerability to cross-site scripting attacks...