EUVD-2025-33711

rardecode: DoS risk due to unrestricted RAR dictionary sizes...

CVE-2025-8917 Path Traversal Leading to Remote Code Execution in allegroai/clearml

A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the safeextract function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical fil...

EUVD-2025-32428

Minecraft RCON Terminal is a VS Code extension that streamlines Minecraft server management. Versions 0.1.0 through 2.0.6 stores passwords using VS Code's configuration API which writes to settings.json in plaintext. This issue is fixed in version 2.1.0...

EUVD-2023-53407

Malicious code in bioql PyPI...

EUVD-2025-29766

Malicious code in bioql PyPI...

EUVD-2021-28047

Malicious code in bioql PyPI...

EUVD-2025-31688

Malicious code in bioql PyPI...

CVE-2025-10191

The Big Post Shipping for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wooboigpostshippingstatus' shortcode in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2025-10191

CVE-2025-10191 concerns the WordPress plugin Big Post Shipping for WooCommerce . The vulnerability is a Stored Cross-Site Scripting (XSS) in the shortcode wooboigpost_shipping_status. Affected versions are up to 2.1.1 (Wordfence listing confirms patching in 2.1.2). The issue stems from insufficie...

CVE-2025-59833 FlagForgeCTF Hint Exposure via API

Flag Forge is a Capture The Flag CTF platform. In versions from 2.1.0 to before 2.3.0, the API endpoint GET /api/problems/:id returns challenge hints in plaintext within the question object, regardless of whether the user has unlocked them via point deduction. Users can view all hints for free,...

CVE-2025-59346

Dragonfly is an open source P2P-based file distribution and image acceleration system. Versions prior to 2.1.0 contain a server-side request forgery SSRF vulnerability that enables users to force DragonFly2’s components to make requests to internal services that are otherwise not accessible to...

CVE-2025-59348

CVE-2025-59348 affects Dragonfly, an open-source P2P file distribution and image acceleration system. The vulnerability lies in the processPieceFromSource method, where an uninitialized variable n is used as a guard for the AddTraffic call instead of the actual result.Size, causing the structure’...

Color-String 安全漏洞

Color-String is a library for parsing and generating CSS color strings by the individual developer Josh Junon. A security vulnerability exists in Color-String version 2.1.1, which stems from malware payload injection and could lead to the redirection of cryptocurrency transactions in a browser...

WordPress BeyondCart Connector plugin <= 3.0.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by kr0d in WordPress Plugin BeyondCart Connector versions = 3.0.1...

CVE-2025-58847

Cross-Site Request Forgery CSRF vulnerability in Yaidier WN Flipbox Pro wn-flipbox-pro allows Reflected XSS.This issue affects WN Flipbox Pro: from n/a through = 2.1...

CVE-2025-57576

PHPGurukul Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting XSS in /admin/updateorder.php...

batteryKid 安全漏洞

batteryKid is a tool to extend battery life by the individual developer of Alaneuler. A security vulnerability exists in batteryKid 2.1 and earlier versions, which stems from a missing authentication in the file PrivilegeHelper/PrivilegeHelper.swift...

CVE-2025-9409

A security flaw has been discovered in lostvip-com ruoyi-go up to 2.1. Impacted is the function DownloadTmp/DownloadUpload of the file modules/system/controller/CommonController.go. Performing manipulation of the argument fileName results in path traversal. It is possible to initiate the attack...

Linux Distros Unpatched Vulnerability : CVE-2019-12107

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The upnpeventprepare function in upnpevents.c in MiniUPnP MiniUPnPd through 2.1 allows a remote attacker to leak information from the heap due to improper...

Linux Distros Unpatched Vulnerability : CVE-2022-47095

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer overflow in hevcparsevpsextension function of mediatools/avparsers.c CVE-2022-47095 Note that Ness...