CVE-2025-3193

The CVE-2025-3193 entry concerns algoliasearch-helper versions 2.0.0-rc1 through 3.11.2 (and earlier) with a Prototype Pollution in the _merge() function of merge.js. The underlying issue allows modification of constructor.prototype and, in an extreme edge-case where the resulting error is caught...

NetApp StorageGRID 安全漏洞

NetApp StorageGRID is a suite of object storage solutions from Network Appliance NetApp. A security vulnerability exists in NetApp StorageGRID versions prior to 11.8.0.15 and prior to 11.9.0.8, which stems from improper privilege management and could result in elevated privileges...

Security Bulletin: Resource Exhaustion and Memory Leak in Multer Due to Improper Stream Handling (Fixed in 2.0.0), affects watsonx.data

Summary Multer is a node.js middleware for handling multipart/form-data. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal busboy stream is not closed, violating Node.js...

Coder 代码问题漏洞

Coder is an application from Coder Inc. that allows for the setup of development environments in public or private cloud infrastructures. A code issue vulnerability exists in Coder versions 2.24.3 and earlier and 2.25.0 through 2.25.1, which stems from mishandling of sessions and could lead to...

CVE-2025-58372 Roo Code: Potential Remote Code Execution via .code-workspace

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a vulnerability where certain VS Code workspace configuration files .code-workspace are not protected in the same way as the .vscode folder. If the agent was configured to auto-appro...

PT-2025-35862

Name of the Vulnerable Software and Affected Versions: Markdownify versions prior to 0.0.2 Description: Markdownify is a Model Context Protocol server for converting content to Markdown. Versions prior to 0.0.2 contain a command injection issue, caused by the unsanitized use of input parameters...

LimonDesk 跨站脚本漏洞

LimonDesk is a real-time chat, work order ticketing, and other ransomware from LimonDesk, a Turkish company. A cross-site scripting vulnerability exists in LimonDesk versions prior to s1.02.14 through v1.ylabel17, which stems from improper input neutralization during web page generation and can...

Linux Distros Unpatched Vulnerability : CVE-2025-24814

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Core creation allows users to replace trusted configset files with arbitrary configuration Solr instances that 1 use the FileSystemConfigSetService component th...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.0.1.8)

The version of AOS installed on the remote host is prior to 7.0.1.8. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.0.1.8 advisory. - setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path...

n8n 跨站脚本漏洞

n8n is a scalable workflow automation tool from the n8n open source. A cross-site scripting vulnerability exists in n8n versions prior to 1.77.0 through 1.98.2, which stems from the presence of stored cross-site scripting in the HTML form element of the Form Trigger node, which could lead to...

Apache Tomcat 11.0.0.M1 < 11.0.10

The version of Tomcat installed on the remote host is prior to 11.0.10. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat11.0.10security-11 advisory. - Tomcat's HTTP/2 implementation was vulnerable to the made you reset attack. The denial of service typically...

CVE-2025-52931 Unexpected input to Update Channel Subscription endpoint causes DoS in Mattermost Confluence Plugin

Mattermost Confluence Plugin version 1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to update channel subscription endpoint with an invalid request body...

BIT-LIBPHP-2021-21706 ZipArchive::extractTo may extract outside of destination dir

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS...

BIT-LIBPHP-2020-7070 PHP parses encoded cookie names so malicious `__Host-` cookies can be sent

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like Host confused with cookies that decode to such prefix, thus leading to an attacker being...

CVE-2024-55402

4C Strategies Exonaut before v22.4 was discovered to contain an access control issue...

Astro 输入验证错误漏洞

Astro is an Astro open source web framework for content-driven websites. An input validation error vulnerability exists in Astro versions 5.2.0 through 5.12.7, which stems from improper handling of double-slash paths and could lead to an open redirection attack...

CVE-2025-54124

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 9.8-rc-1 through 16.4.6, 16.5.0-rc-1 through 16.10.4, and 17.0.0-rc-1 through 17.1.0, any user with editing rights can creat...

CVE-2025-49179 affecting package xorg-x11-server for versions less than 1.20.10-16

CVE-2025-49179 affecting package xorg-x11-server for versions less than 1.20.10-16. A patched version of the package is available...

PT-2025-32283 · Imanami +1 · Groupid +1

Name of the Vulnerable Software and Affected Versions: Netwrix Directory Manager versions 11.0.0.0 through 11.1.25161.02 Description: Netwrix Directory Manager formerly Imanami GroupID inserts sensitive information into data sent to authenticated users. Recommendations: Update to version...

PT-2025-32261 · 4C Strategies · Exonaut

Name of the Vulnerable Software and Affected Versions: 4C Strategies Exonaut versions prior to 22.4 Description: An issue allows attackers to execute a directory traversal. Recommendations: Update to version 22.4 or later...