A Systematic Evaluation of Parameter-Efficient Fine-Tuning Methods for the Security of Code LLMs

Code-generating Large Language Models LLMs significantly accelerate software development. However, their frequent generation of insecure code presents serious risks. We present a comprehensive evaluation of seven parameter-efficient fine-tuning PEFT techniques, demonstrating substantial gains in...

osCommerce 安全漏洞

osCommerce is an open source online shopping e-commerce solution based on the GNUGPL license from osCommerce, Inc. A security vulnerability exists in osCommerce 2.2 RC2a and earlier versions, which stems from a lack of input validation and access control in the Manage File Manager tool, and could...

Flowise has unsandboxed remote code execution via Custom MCP

Summary The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls RBAC. Furthermore, the default installation of...

Security update for krb5

This update for krb5 fixes the following issues: CVE-2025-3576: weakness in the MD5 checksum design allows for spoofing of GSSAPI-protected messages that are using RC4-HMAC-MD5 bsc1241219. Krb5, as a very old protocol, supported quite a number of ciphers that are not longer up to current...

CVE-2025-10440 D-Link DI-8100/DI-8100G/DI-8200/DI-8200G/DI-8003/DI-8003G jhttpd usb_paswd.asp sub_4621DC os command injection

A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Affected by this vulnerability is the function sub4621DC of the file usbpaswd.asp of the component jhttpd. The manipulation of the argument hname leads to os comma...

PT-2025-37765

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Student File Management System version 1.0 Description: A weakness exists in SourceCodester Online Student File Management System 1.0 related to unrestricted file upload through manipulation of the /save file.php file an...

CVE-2025-10320 iteachyou Dreamer CMS updatePwd weak password

A vulnerability was detected in iteachyou Dreamer CMS up to 4.1.3.2. This issue affects some unknown processing of the file /admin/user/updatePwd. Performing manipulation results in weak password requirements. Remote exploitation of the attack is possible. A high degree of complexity is needed fo...

CVE-2025-55048

Multiple CWE-78...

CVE-2025-55053

CWE-328: Use of Weak Hash...

Exploit for CVE-2025-46408

CVE-2025-46408 Improper Hostname Verification in EagleEyes...

IBM Security Verify Information Queue 加密问题漏洞

IBM Security Verify Information Queue is an integration product from International Business Machines IBM, Inc. utilizes Kafka technology and a publish/subscribe model to integrate data between IBM Security products. A cryptographic issue vulnerability exists in IBM Security Verify Information Que...

Linux Distros Unpatched Vulnerability : CVE-2010-3804

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The JavaScript implementation in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, uses a weak...

CVE-2025-55047

CWE-798 Use of Hard-coded Credentials...

CVE-2025-55053

CWE-328: Use of Weak Hash...

CVE-2025-55051

CVE-2025-55051 corresponds to CWE-1392 (Use of Default Credentials) with a CVSSv3.1 base score 10.0 (CRITICAL, NETWORK, no user interaction) affecting Baicells devices: Nova436Q; Nova430e/430i; NEUTRINO430; NOVA846. Root cause stated: default credentials being used leads to security feature bypas...

CVE-2025-55050

CWE-1242: Inclusion of Undocumented Features...

CVE-2025-55049

CVE-2025-55049: Use of a default cryptographic key (CWE-1394) with a root cause of hard-coded/public key in affected components. Concrete detail in sources identifies Baicells NEUTRINO430 LTE base stations as affected; other entries confirm the vulnerability name. Exploitation status is not provi...

CVE-2025-55049

Use of Default Cryptographic Key CWE-1394...

CVE-2025-55048

Multiple CWE-78...

CVE-2025-55047

Baicells SPECTRA LTE-U eNB outdoor base station is affected by a trust management issue described as hard-coded credentials (CVE-2025-55047). Root cause: hard-coded credentials leading to potential security feature bypass. Impact: unauthorized access or bypass of security features as indicated by...