6429 matches found
CVE-2025-5305
The Password Reset with Code for WordPress REST API WordPress plugin before 0.0.17 does not use cryptographically sound algorithms to generate OTP codes, potentially leading to account takeovers...
Bluetooth Component Information Disclosure
The vulnerability of Bluetooth components in iOS, iPadOS, tvOS, watchOS, visionOS, and macOS stems from insufficient protection of registration data. Exploiting this vulnerability can allow attackers to gain unauthorized access to confidential information...
MYCVE
Hnaoyun Inc. PbootCMS Project V3.2.12 apps/home/controller/Mem...
A Systematic Evaluation of Parameter-Efficient Fine-Tuning Methods for the Security of Code LLMs
Code-generating Large Language Models LLMs significantly accelerate software development. However, their frequent generation of insecure code presents serious risks. We present a comprehensive evaluation of seven parameter-efficient fine-tuning PEFT techniques, demonstrating substantial gains in...
osCommerce 安全漏洞
osCommerce is an open source online shopping e-commerce solution based on the GNUGPL license from osCommerce, Inc. A security vulnerability exists in osCommerce 2.2 RC2a and earlier versions, which stems from a lack of input validation and access control in the Manage File Manager tool, and could...
CVE-2025-39816: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: iouring/kbuf: always use READONCE to read ring provided buffer lengths Since the buffers are mapped from userspace, it is prudent to use READONCE to read the value into a local variable, and use that for any other actions taken...
Totolink A3002R Router Arbitrary Command Execution
The vulnerability of the bupload.html component in the Totolink A3002R router microprogramming software is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
Flowise has unsandboxed remote code execution via Custom MCP
Summary The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls RBAC. Furthermore, the default installation of...
Security update for krb5
This update for krb5 fixes the following issues: CVE-2025-3576: weakness in the MD5 checksum design allows for spoofing of GSSAPI-protected messages that are using RC4-HMAC-MD5 bsc1241219. Krb5, as a very old protocol, supported quite a number of ciphers that are not longer up to current...
CVE-2025-10440 D-Link DI-8100/DI-8100G/DI-8200/DI-8200G/DI-8003/DI-8003G jhttpd usb_paswd.asp sub_4621DC os command injection
A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Affected by this vulnerability is the function sub4621DC of the file usbpaswd.asp of the component jhttpd. The manipulation of the argument hname leads to os comma...
CVE-2023-53257: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check S1G action frame size Before checking the action code, check that it even exists in the frame...
PT-2025-37765
Name of the Vulnerable Software and Affected Versions: SourceCodester Online Student File Management System version 1.0 Description: A weakness exists in SourceCodester Online Student File Management System 1.0 related to unrestricted file upload through manipulation of the /save file.php file an...
HikCentral Professional Privilege Escalation
The vulnerability of the HikCentral Professional security management system is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...
Adobe Experience Manager Auth Bypass Info Disclosure
The vulnerability of the Adobe Experience Manager AEM content and media data management system is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker to bypass security restrictions and disclose sensitive information...
NTLM Privilege Escalation
The vulnerability of the NTLM protocol implementation in Windows operating systems is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to enhance their privileges remotely...
CVE-2025-10320 iteachyou Dreamer CMS updatePwd weak password
A vulnerability was detected in iteachyou Dreamer CMS up to 4.1.3.2. This issue affects some unknown processing of the file /admin/user/updatePwd. Performing manipulation results in weak password requirements. Remote exploitation of the attack is possible. A high degree of complexity is needed fo...
WhatsApp Authentication Bypass Data Compromise
The vulnerability of the WhatsApp messaging and video call application is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the information protected by the service...
CVE-2025-55048
Multiple CWE-78...