AZL-58413 CVE-2025-22870 affecting package prometheus-process-exporter for versions less than 0.8.2-2

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to ".example.com", a request to "::1%25.example.com:80 will incorrectly match and not be proxied...

AZL-58440 CVE-2025-22870 affecting package telegraf for versions less than 1.29.4-15

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to ".example.com", a request to "::1%25.example.com:80 will incorrectly match and not be proxied...

1E Client 安全漏洞

1E Client is an agent-less endpoint management software from 1E Client USA. A security vulnerability exists in 1E Client versions prior to 25.3 that stems from improper link resolution prior to file access, which could allow a local attacker to delete arbitrary files...

Ratify 授权问题漏洞

Ratify is an artifact approval framework CNCF sandbox from Ratify open source. An authorization issue vulnerability exists in Ratify version 1.2.3 and prior to version 1.3.2 that stems from the Azure Authentication Provider not verifying that the target registry is ACR, which could lead to misuse...

AZL-58362 CVE-2025-2137 affecting package nodejs 20.14.0-13

Out of bounds read in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. Chromium security severity: Medium...

Tap&Sign 安全漏洞

Tap&Sign is an easy-to-use, legally binding electronic signature solution from Tap&Sign, Inc. A security vulnerability exists in Tap&Sign versions prior to V.1.025 that stems from sensitive information stored in plaintext in an environment variable and a weak password recovery mechanism that coul...

picklescan 数据伪造问题漏洞

picklescan is a security scanning program by the individual developer Matthieu Maitre. A data forgery issue vulnerability exists in picklescan versions prior to 0.0.23, which stems from a ZIP file manipulation that may cause a crash, thereby bypassing malicious payload detection...

UBUNTU-CVE-2025-27796

ReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation, resulting in out-of-bounds access to heap memory in ReadBlob...

Axios 代码问题漏洞

Axios is an HTTP client based on Promise a solution for asynchronous programming from the Axios open source. A code issue vulnerability exists in Axios versions prior to 1.8.2 that stems from passing absolute URLs could lead to SSRF and credential disclosure...

CVE-2025-0877 XSS in AtaksAPP's Reservation Management System

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in AtaksAPP Reservation Management System allows Cross-Site Scripting XSS. This issue affects Reservation Management System: before 4.2.3...

WordPress WooCommerce Recover Abandoned Cart plugin < 24.5.0 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Lucio Sá in WordPress Plugin WooCommerce Recover Abandoned Cart versions 24.5.0...

CVE-2024-9149

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Wind Media E-Commerce Website Template allows SQL Injection. This issue affects E-Commerce Website Template: before v1.5...

CVE-2024-50705

Unauthenticated reflected cross-site scripting XSS vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary scripts via the page parameter...

CVE-2024-9149 SQLi in Wind Media's E-Commerce Website Template

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Wind Media E-Commerce Website Template allows SQL Injection. This issue affects E-Commerce Website Template: before v1.5...

CVE-2024-9149 SQLi in Wind Media's E-Commerce Website Template

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Wind Media E-Commerce Website Template allows SQL Injection. This issue affects E-Commerce Website Template: before v1.5...

WordPress Edd Google Sheet Connector Pro plugin < 1.4 - Cross-Site Request Forgery to Access Code Update vulnerability

Cross-Site Request Forgery to Access Code Update vulnerability discovered by Erwan LR in WordPress Plugin Edd Google Sheet Connector Pro versions 1.4...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 136, which stems from privilege grant spoofing...

Linux Distros Unpatched Vulnerability : CVE-2016-8624

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '' character, and could instead be...

Uniguest Tripleplay 跨站请求伪造漏洞

Uniguest Tripleplay is a multimedia player from Uniguest. A security vulnerability exists in Uniguest Tripleplay versions prior to 24.2.1 that stems from reflective cross-site scripting...

mysiteforme SQL注入漏洞

mysiteforme is a privilege management system for wangl1989 individual developers. A security vulnerability exists in versions of mysiteforme prior to 2025.01.1, which stems from the presence of a SQL injection issue...