8482 matches found
Audiobookshelf 跨站脚本漏洞
Audiobookshelf is a self-hosted audiobook and podcast server from Audiobookshelf open source. A cross-site scripting vulnerability exists in Audiobookshelf versions prior to 2.21.0, which stems from improper handling of input in the /api/upload endpoint and could lead to a reflective cross-site...
Medium: docker
Issue Overview: In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. CVE-2022-27664 Affected Packages: docker Note: This advisory is applicable to Amazon...
Improper Cleanup on Thrown Exception
Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Improper Cleanup on Thrown Exception when handling failed HTTP/2 requests with certain invalid HTTP priority headers. An attacker can trigger an...
RHSA-2025:4228 Red Hat Security Advisory: mod_auth_openidc:2.3 security update
Bulletin has no description...
undertow: client side invocation timeout raised when calling over HTTP2
A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks...
CVE-2025-46655
CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be bypassed in certain cases of different-origin file storage, such as AWS S3. NOTE: it can be considered a user error if AWS is employed for hosting untrusted...
glibc security update
2.34-125.0.1.8 - Forward-port Oracle patches for ol9-u5 glibc-2.34-125.0.1.8 Reviewed by: David Faust Oracle history:...
SIOS Technology Quick Agent 路径遍历漏洞
SIOS Technology Quick Agent is a component of a high availability and disaster recovery solution from SIOS Technology, Inc. that is used to monitor and protect business critical applications. A path traversal vulnerability exists in SIOS Technology Quick Agent V3 and V2, which stems from an...
CVE-2025-46689
CVE-2025-46689 affects Ververica Platform 2.14.0 with a Reflected XSS vulnerability exposed via the URI path namespaces/default/formats . The issue involves user-controlled input in that path, allowing an attacker to trigger script execution in a victim’s browser when the vulnerable page is loade...
CVE-2025-32389
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Prior to version 2.1.4, NamelessMC is vulnerable to SQL injection by providing an unexpected square bracket GET parameter syntax. Square bracket GET parameter syntax refers to the structure ?param0=a1=b2=c utiliz...
CVE-2024-56156 Halo Vulnerable to Stored XSS and RCE via File Upload Bypass
Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validation controls. This bypass enables the upload of malicious files including executables and HTML files, which can lead to stored cross-site scripting attacks a...
CVE-2025-46495 WordPress Drop Caps plugin <= 2.1 - CSRF to XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in tomontoast Drop Caps drop-caps allows Stored XSS.This issue affects Drop Caps: from n/a through = 2.1...
CVE-2025-46452 WordPress Google News plugin <= 2.5.1 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in Olav Kolbu Google News allows Stored XSS. This issue affects Google News: from n/a through 2.5.1...
CVE-2025-46226 WordPress MPL-Publisher <= 2.18.0 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ferranfg MPL-Publisher allows Stored XSS. This issue affects MPL-Publisher: from n/a through 2.18.0...
AZL-61768 CVE-2024-58250 affecting package ppp 2.5.0-1
The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges...
CVE-2025-3816
A vulnerability classified as critical was found in westboy CicadasCMS 2.0. This vulnerability affects unknown code of the file /system/schedule/save of the component Scheduled Task Handler. The manipulation leads to os command injection. The attack can be initiated remotely. The exploit has been...
PYSEC-2025-41
PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution RCE vulnerability exists in PyTorch when loading a model using torch.load with...
CVE-2025-30357 NamelessMC Forum Topic Deletion Triggered by Unrelated User Deletion
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, if a malicious user is leaving spam comments on many topics then an administrator, unable to manually remove each spam comment, may delete the malicious account. Once an administrator...
The vulnerability of the ocfs2_reflink_xattrInline() function in the cluster file system ocfs2 of the Linux operating system allows a attacker to cause a service failure.
The vulnerability of the ocfs2reflinkxattrInline function in the cluster file system ocfs2 of the Linux operating system is related to incorrect input validation. Exploiting this vulnerability could allow an attacker to cause service failures...