Allocation of Resources Without Limits or Throttling

Overview std/net/mail is a Go standard library package std/net/mail Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. Go Vulnerability Report:The ParseAddress function constructs domain-literal address components through repeated string...

EUVD-2025-36685

In Search Guard versions 3.1.1 and earlier, Field Masking FM rules are improperly enforced on fields of type IP IP Address. While the content of these fields is properly redacted in the source document returned by search operations, the results do return documents hits when searching based on a...

Malicious Package

Overview dezcord.js is a malicious package. This is a "typosquatting" package, which means the package name is based on existing repositories, namespaces, or components, it aims to trick users to download the package which contains a malicious code. Payload behavior The malicious payload runs npm...

Malicious Package

Overview etherdjs is a malicious package. This is a "typosquatting" package, which means the package name is based on existing repositories, namespaces, or components, it aims to trick users to download the package which contains a malicious code. Payload behavior The malicious payload runs npm's...

Malicious Package

Overview react-router-dom.js is a malicious package. This is a "typosquatting" package, which means the package name is based on existing repositories, namespaces, or components, it aims to trick users to download the package which contains a malicious code. Payload behavior The malicious payload...

Jenkins Themis Plugin is missing a permission check

Jenkins Themis Plugin 1.4.1 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified URL. Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery CSRF...

CVE-2025-12148

In CVE-2025-12148, Floragunn Search Guard FLX versions 3.1.1 and earlier expose a vulnerability where Field Masking (FM) rules are not properly enforced on IP-type fields. Although the redacted _source is returned, search hits can be based on specific IP values, enabling reconstruction of the ori...

CVE-2025-12148 Unauthorized access to fields protected by Field Masking (FM) for fields of type IP

In Search Guard versions 3.1.1 and earlier, Field Masking FM rules are improperly enforced on fields of type IP IP Address. While the content of these fields is properly redacted in the source document returned by search operations, the results do return documents hits when searching based on a...

CVE-2025-34315

IPFire versions prior to 2.29 Core Update 198 contain a stored cross-site scripting XSS vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the REMOTELOGADDR parameter when updating the remote syslog server address. When a user updates the Remote loggin...

CVE-2025-64139

A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL...

CVE-2025-64139

A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL...

CVE-2025-64138

A cross-site request forgery CSRF vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL...

GHSA-5JPX-9HW9-2FX4 NextAuthjs Email misdelivery Vulnerability

Summary NextAuth.js's email sign-in can be forced to deliver authentication emails to an attacker-controlled mailbox due to a bug in nodemailer's address parser used by the project fixed in nodemailer v7.0.7. A crafted input such as: "[email protected]"@victim.com is parsed incorrectly and results i...

CVE-2025-64229

creationtimestamp| type| source ---|---|--- 2025-10-29 09:37:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m4d5k7qns62s...

Sensitive Information Exposure

com.liferay.portal, com.liferay.portal.kernel is vulnerable to Sensitive Information Exposure. The vulnerability is due to remote staging not properly obtaining the live site's remote address from the database, which allows remote authenticated users—who can obtain the staging server’s shared...

bpf: Explicitly check accesses to bpf_sock_addr

...

SUSE CVE-2025-40078

In the Linux kernel, the following vulnerability has been resolved: bpf: Explicitly check accesses to bpfsockaddr Syzkaller found a kernel warning on the following sockaddr program: 0: r0 = 0 1: r2 = u32 r1 +60 2: exit which triggers: verifier bug: error during ctx access conversion 0 This is...

Jenkins Start Windocks Containers Plugin 安全漏洞

Jenkins Start Windocks Containers Plugin is an open source plugin for Jenkins to link WinDocks hosts. A security vulnerability exists in Jenkins Start Windocks Containers Plugin 1.4 and earlier versions, which stems from a lack of privilege checking and could lead an attacker to connect to an...

tc Tor Chat Client 1.3

tc is a low-tech free solution to make yourself anonymously reachable for chat by anyone who only know your onion address and your public key. Messages are PGP encrypted end-to-end and forwarded by Tor's relays...

PT-2025-44310

Name of the Vulnerable Software and Affected Versions Search Guard versions 3.1.1 and earlier Description Field Masking FM rules are not properly enforced on fields of type IP IP Address. While the content of these fields is redacted in search results, documents are still returned when searching...