OpenBao suffers from an unspecified vulnerability (CNVD-2025-18607)

OpenBao is OpenBao open source a sensitive data management software . A security vulnerability exists in OpenBao versions 0.1.0 through 2.3.1, which stems from the TOTP key engine being able to accept valid code multiple times, and no details of the vulnerability are provided at this time...

Linux Distros Unpatched Vulnerability : CVE-2020-10030

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. It allows an attacker with enough privileges to change the system's hostname to...

dm-ide (>=0.0.1 <=1.2.8) potentially affected by unknown CVE via electrin (=0.0.1-security)

electrin NPM version =0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on electrin and may be impacted: - dm-ide =0.0.1, =1.2.8 Source cves: unknown CVE Source advisory: OSV:MAL-2025-19424...

radio-paradise-api (=0.0.1), turkish-synonyms-api (=0.0.0) potentially affected by unknown CVE via memoize-with-leveldb (>=0.0.1 <=2.0.0)

memoize-with-leveldb NPM version =0.0.1, =2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on memoize-with-leveldb and may be impacted: - radio-paradise-api =0.0.1 - turkish-synonyms-api =0.0.0 Source cves: unknown CVE Source advisory:...

CVE-2025-53221

CVE-2025-53221 affects WordPress plugin CodeablePress (

CVE-2025-53241

CVE-2025-53241 is a Server-Side Request Forgery (SSRF) affecting the WordPress Simplified plugin, with vulnerable versions listed as n/a through 1.0.9 (and related notes indicating up to 1.0.11 in advisories). The underlying issue is an SSRF vulnerability in Simplified that permits the server to ...

CVE-2025-54409 AIDE null pointer dereference when reading incorrectly encoded xattr attributes from database (local DoS)

AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a...

CVE-2025-36047 IBM WebSphere Application Server Liberty denial of service

IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources...

CVE-2025-28987

Server-Side Request Forgery SSRF vulnerability in PressForward PressForward pressforward allows Server Side Request Forgery.This issue affects PressForward: from n/a through = 5.9.5...

IBM WebSphere Application Server Liberty 17.0.0.3 < 25.0.0.9 (7242027)

The version of IBM WebSphere Application Server Liberty running on the remote host is affected by a vulnerability as referenced in the 7242027 advisory. - IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 could allow a remote attacker to bypass security restrictions caused by a...

CVE-2025-54063

Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.4.8 to 1.5.0, there is a one-click remote code execution vulnerability through the custom URL handling. An attacker can exploit this by hosting a malicious website or embedding a specially crafted URL on a...

CVE-2024-12303

Removed by vendor...

CVE-2025-2614

Removed by vendor...

CVE-2025-54074

CVE-2025-54074 affects Cherry Studio desktop client, versions 1.2.5–1.5.1, which are vulnerable to OS command injection when connecting to a malicious MCP server over HTTP Streamable mode. The underlying issue arises during the OAuth-enabled connection process, allowing an attacker-controlled MCP...

CVE-2025-8891 OceanWP <= 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Ocean Extra Plugin Installation

The OceanWP theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.0.9 to 4.1.1. This is due to missing or incorrect nonce validation on the oceanwpnoticebuttonclick function. This makes it possible for unauthenticated attackers to install the Ocean Extra plugin via a forge...

Cherry Studio 操作系统命令注入漏洞

Cherry Studio is a multi-model AI assistant from China Thousand Comets Cherry Studio. An OS command injection vulnerability exists in Cherry Studio versions 1.2.5 through 1.5.1, which stems from an OS command injection when connecting to a malicious MCP server...

CVE-2025-36000 IBM WebSphere Application Server Liberty cross-site scripting

IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure with...

CVE-2025-36124 IBM WebSphere Application Server Liberty bypass security

IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 could allow a remote attacker to bypass security restrictions caused by a failure to honor JMS messaging configuration...

CVE-2024-41979

CVE-2024-41979 affects Siemens SmartClient modules Opcenter QL Home, SOA Audit, and SOA Cockpit (versions 13.2 through 2505). Root cause: the server does not enforce mandatory authorization on some functionality levels, allowing an authenticated attacker to gain complete access to the application...

com.walterjwhite.java.examples:ssh (=0.0.17), com.walterjwhite.java.modules.linux-builder.modules.cli.providers:cdi (=0.0.17) +23 more potentially affected by CVE-2025-8885 via org.bouncycastle:bcprov-ext-jdk14 (>=1.51 <=1.72)

org.bouncycastle:bcprov-ext-jdk14 MAVEN version =1.51, =0.1.0, =0.1.0, =0.1.2 - io.github.qsy7.java.modules.linux-builder.modules.cli.providers:guice =0.1.0 and more Source cves: CVE-2025-8885 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-11777847...