BIT-MONGODB-2025-10060 MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation

MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork state management. This issue affects MongoDB Server v6.0...

SUSE-SU-2025:03268-1 Security update for curl

This update for curl fixes the following issues: Security issues fixed: - CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in heap buffer bsc1249191. - CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious serv...

Suricata IDPE 8.0.1

Suricata is a network intrusion detection and prevention engine developed by the Open Information Security Foundation and its supporting vendors. The engine is multi-threaded and has native IPv6 support. It's capable of loading existing Snort rules and signatures and supports the Barnyard and...

GO-2025-3960 Mattermost Open Redirect vulnerability in github.com/mattermost/mattermost-server

Mattermost Open Redirect vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

mysql: Replication unspecified vulnerability (CPU Jul 2025)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Replication. Supported versions that are affected are 8.0.0-8.0.42. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attac...

MongoDB 6.0.x < 6.0.24 / 7.0.x < 7.0.18 / 8.0.x < 8.0.6 (SERVER-100901)

The version of MongoDB installed on the remote host is 6.0 prior to 6.0.24, 7.0 prior to 7.0.18, and 8.0 prior to 8.0.6. It is, therefore, affected by a vulnerability as referenced in the SERVER-100901 advisory. - An improper setting of the lsid field on any sharded query can cause a crash in...

Type Confusion

Overview Affected versions of this package are vulnerable to Type Confusion in v8. This vulnerability has been reported exploited in the wild. Remediation Upgrade chromium to version 140.0.7339.185 or higher. References - Chrome Releases - CISA - Known Exploited Vulnerabilities...

CVE-2025-5005

CVE-2025-5005 affects Lingdang CRM up to 8.6.5.4. The vulnerability is a server-side request forgery (SSRF) in an unknown function of the file crm/WeiXinApp/dingtalk/index_event.php, caused by manipulation of the corpurl argument. Reports indicate the attack can be launched remotely and that the ...

Proxmox Virtual Environment 安全漏洞

Proxmox Virtual Environment Proxmox VE is an open source server virtualization environment Linux distribution from Proxmox. A security vulnerability exists in Proxmox Virtual Environment version 8.4, which stems from a stored cross-site scripting vulnerability in the WebAuthn Relying Party field...

MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation

MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork state management. This issue affects MongoDB Server v6.0...

CVE-2025-58789

CVE-2025-58789 describes an SQL Injection in the WordPress plugin WP Full Stripe Free (affected: versions up to 8.3.0; some sources cite until 8.2.5 and up to 8.3.0). The vulnerability arises from improper neutralization of special elements in SQL commands, enabling an attacker to potentially man...

Presta Shop vulnerable to email enumeration

Impact An unauthenticated attacker with access to the back-office URL can manipulate the idemployee and resettoken parameters to enumerate valid back-office employee email addresses. Impacted parties: Store administrators and employees: their email addresses are exposed. Merchants: risk of...

Linux Distros Unpatched Vulnerability : CVE-2021-32773

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Racket is a general-purpose programming language and an ecosystem for language-oriented programming. In versions prior to 8.2, code evaluated using the Racket...

GO-2025-3901 Mattermost Fails to Validate File Paths in github.com/mattermost/mattermost-server

Mattermost Fails to Validate File Paths in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

GO-2025-3911 Mattermost has Potential Server Crash due to Unvalidated Import Data in github.com/mattermost/mattermost-server

Mattermost has Potential Server Crash due to Unvalidated Import Data in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

CVE-2025-40704

The CVE-2025-40704 entry concerns OpenAtlas v8.9.0 (ACDH-CH). Affected component is the POST /insert/edition endpoint, with the vulnerability due to inadequate validation of the name parameter in user input. This can allow a remote attacker to craft queries that reach an authenticated user and po...

OpenAtlas 跨站脚本漏洞

OpenAtlas is an Android non-proxy dynamic deployment framework from the Austrian company OpenAtlas. A cross-site scripting vulnerability exists in OpenAtlas version v8.9.0, which stems from insufficient validation of user input in a POST request and could lead to a cross-site scripting attack...

OpenAtlas 跨站脚本漏洞

OpenAtlas is an Android non-proxy dynamic deployment framework from the Austrian company OpenAtlas. A cross-site scripting vulnerability exists in OpenAtlas version v8.9.0, which stems from insufficient validation of user input in a POST request and could lead to a cross-site scripting attack...

OpenAtlas 跨站脚本漏洞

OpenAtlas is an Android non-proxy dynamic deployment framework from the Austrian company OpenAtlas. A cross-site scripting vulnerability exists in OpenAtlas version v8.9.0, which stems from insufficient validation of user input in a POST request and could lead to a cross-site scripting attack...

PT-2025-35210

Name of the Vulnerable Software and Affected Versions: OpenAtlas version 8.9.0 Description: OpenAtlas is susceptible to a cross-site scripting XSS issue caused by insufficient validation of user input received through POST requests. This could allow a remote user to send crafted queries to an...