CVE-2025-10993

A security flaw has been discovered in MuYuCMS up to 2.7. Affected by this issue is some unknown functionality of the file /admin.php of the component Template Management. The manipulation results in code injection. It is possible to launch the attack remotely...

Portábilis i-Educar 授权问题漏洞

Portábilis i-Educar is an application from Portábilis. It can easily help you with basic and technical education. An authorization issue vulnerability exists in Portábilis i-Educar 2.10 and earlier versions, which stems from improper authorization of the parameter alunoid in the file...

WordPress plugin Woostify 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site...

PT-2025-39658

Name of the Vulnerable Software and Affected Versions Flag Forge versions 2.0.0 through 2.3.0 Description Flag Forge, a Capture The Flag CTF platform, has an issue where the public API endpoint /api/user/username returns user email addresses in its JSON response. This exposes sensitive user...

PT-2025-39473

Name of the Vulnerable Software and Affected Versions MuYuCMS versions prior to 2.7 Description A security flaw exists in MuYuCMS up to version 2.7. This issue is related to an unknown functionality within the /admin.php file of the Template Management component, allowing for code injection. The...

WordPress plugin SKT Blocks 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-59827

Flag Forge is a Capture The Flag CTF platform. In version 2.1.0, the /api/admin/assign-badge endpoint lacks proper access control, allowing any authenticated user to assign high-privilege badges e.g., Staff to themselves. This could lead to privilege escalation and impersonation of administrative...

AZL-68100 CVE-2025-55551 affecting package pytorch 2.2.2-16

An issue in the component torch.linalg.lu of pytorch v2.8.0 allows attackers to cause a Denial of Service DoS when performing a slice operation...

AZL-68117 CVE-2025-55551 affecting package pytorch 2.0.0-14

An issue in the component torch.linalg.lu of pytorch v2.8.0 allows attackers to cause a Denial of Service DoS when performing a slice operation...

CVE-2025-40698

CVE-2025-40698 concerns Prevengos, a vulnerability in Prevengos v2.44 by Nedatec Consulting. A SQL injection is triggered via a POST to the API endpoint "/servicios/autorizaciones.asmx/mfsRecuperarListado" using the parameters mpsCentroin , mpsEmpresa , mpsProyecto , and mpsContrata . The affecte...

CVE-2025-40698 SQL injection vulnerability in Prevengos

SQL injection vulnerability in Prevengos v2.44 by Nedatec Consulting. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameters “mpsCentroin”, “mpsEmpresa”, “mpsProyecto”, and “mpsContrata” in...

undertow: information leakage via HTTP/2 request header reuse

REJECTED CVE A vulnerability has been identified in the Undertow package where the readHpackString method may incorrectly reuse an HTTP request header value from a previous stream for a new request on the same HTTP/2 connection due to improper handling of the stringBuilder field. While this...

TensorFlow 安全漏洞

TensorFlow is a suite of end-to-end open source platforms for machine learning open-sourced by TensorFlow. A security vulnerability exists in TensorFlow version 2.18.0 that stems from the output of random results when compiling Embedding, which could lead to unexpected behavior in the application...

CVE-2025-55552

pytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randnlike are used together...

CVE-2025-55551

An issue in the component torch.linalg.lu of pytorch v2.8.0 allows attackers to cause a Denial of Service DoS when performing a slice operation...

CVE-2025-55556

TensorFlow v2.18.0 was discovered to output random results when compiling Embedding, leading to unexpected behavior in the application...

Vulnerability-Lookup 跨站脚本漏洞

Vulnerability-Lookup is an open source Vulnerability-Lookup platform for managing disclosure of vulnerabilities. A cross-site scripting vulnerability exists in Vulnerability-Lookup version 2.16.0 that stems from insufficient cleanup of user input and could lead to a cross-site scripting attack...

PT-2025-39418

Name of the Vulnerable Software and Affected Versions Flag Forge versions 2.2.0 through 2.3.0 Description Flag Forge improperly manages session invalidation. After a user logs out, they can still access protected endpoints, such as /api/profile, and CSRF tokens remain valid. This allows continued...

CVE-2025-59833 FlagForgeCTF Hint Exposure via API

Flag Forge is a Capture The Flag CTF platform. In versions from 2.1.0 to before 2.3.0, the API endpoint GET /api/problems/:id returns challenge hints in plaintext within the question object, regardless of whether the user has unlocked them via point deduction. Users can view all hints for free,...

CVE-2025-59828

Claude Code is an agentic coding tool. Prior to Claude Code version 1.0.39, when using Claude Code with Yarn versions 2.0+, Yarn plugins are auto-executed when running yarn --version. This could lead to a bypass of the directory trust dialog in Claude Code, as plugins would be executed prior to t...