CVE-2025-59042

PyInstaller bundles a Python application and all its dependencies into a single package. Due to a special entry being appended to sys.path during the bootstrap process of a PyInstaller-frozen application, and due to the bootstrap script attempting to load an optional module for bytecode decryptio...

CVE-2025-59042 PyInstaller has local privilege escalation vulnerability

PyInstaller bundles a Python application and all its dependencies into a single package. Due to a special entry being appended to sys.path during the bootstrap process of a PyInstaller-frozen application, and due to the bootstrap script attempting to load an optional module for bytecode decryptio...

CVE-2025-59042

PyInstaller bundles a Python application and all its dependencies into a single package. Due to a special entry being appended to "sys.path" during the bootstrap process of a PyInstaller-frozen application, and due to the bootstrap script attempting to load an optional module for bytecode...

CVE-2025-44595

Halo v2.20.17 and before is vulnerable to Cross Site Scripting XSS in /halohost/archives/name...

CVE-2025-58765 wabac.js has XSS vulnerability in 404 error handling logic

wabac.js provides a full web archive replay system, or 'wayback machine', using Service Workers. A Reflected Cross-Site Scripting XSS vulnerability exists in the 404 error handling logic of wabac.js v2.23.10 and below. The parameter requestURL derived from the original request target is directly...

CVE-2025-58144

creationtimestamp| type| source ---|---|--- 2025-09-09 10:05:42+00:00| seen| https://seclists.org/oss-sec/2025/q3/158 2025-09-11 16:46:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lyl767343d2c...

PT-2025-36997

Name of the Vulnerable Software and Affected Versions: PyInstaller versions prior to 6.0.0 Description: PyInstaller packages Python applications and their dependencies into a single package. A specially crafted entry appended to sys.path during the bootstrap process of a PyInstaller-frozen...

CVE-2025-58755 MONAI has path traversal issue that may lead to arbitrary file writes

MONAI Medical Open Network for AI is an AI toolkit for health care imaging. The extractall function zipfile.extractalloutputdir is used directly to process compressed files. It is used in many places in the project. In versions up to and including 1.5.0, when the Zip file containing malicious...

GNU Tar Memory Allocation DoS

The vulnerability of the GNU Tar archive manager is related to insufficient memory allocation for the operation. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

CVE-2025-58826

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Eric Mann WP Publication Archive wp-publication-archive allows Stored XSS.This issue affects WP Publication Archive : from n/a through = 3.0.1...

Directory Traversal

Overview internetarchive is an A Python interface to archive.org. Affected versions of this package are vulnerable to Directory Traversal via the download function in the file.py file, which does not properly sanitize user-supplied filenames or validate the final download path. An attacker can...

Exploit for Deserialization of Untrusted Data in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

log4j-finder A Python3 script to scan the filesystem to find Log4j2 that is vulnerable to Log4Shell CVE-2021-44228 & CVE-2021-45046 & CVE-2021-45105. It scans recursively both on disk and inside nested Java Archive files JARs. How it works log4j-finder identifies log4j2 libraries on your filesyst...

ch.epfl.bluebrain.nexus:cli_2.13 (>=1.5.0-rc4, <=1.6.1), ch.epfl.bluebrain.nexus:delta-app_2.13 (>=1.9.0-m1, <=1.9.0-m12-2) +578 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.13 (>=2.0.0, <=2.5.12)

co.fs2:fs2-io2.13 MAVEN version =2.0.0, =1.5.0-rc4, =1.9.0-m1, =1.8.0-m4, =1.8.0-m4, =1.8.0-m4, =1.8.0-m4, =1.8.0-m4, =1.8.0-m4, =1.5.0-rc4, =1.8.0-m4, =0.3.0, =0.22.0, =0.0.1, =0.2.0, =0.2.0, =0.8.3 and more Source cves: CVE-2025-58369 Source advisory: GHSA-RRW2-PX9J-QFFJ...

CVE-2025-58826

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Eric Mann WP Publication Archive wp-publication-archive allows Stored XSS.This issue affects WP Publication Archive : from n/a through = 3.0.1...

CVE-2025-58826 WordPress WP Publication Archive Plugin <= 3.0.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Eric Mann WP Publication Archive wp-publication-archive allows Stored XSS.This issue affects WP Publication Archive : from n/a through = 3.0.1...

CVE-2025-58826 WordPress WP Publication Archive Plugin <= 3.0.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Eric Mann WP Publication Archive wp-publication-archive allows Stored XSS.This issue affects WP Publication Archive : from n/a through = 3.0.1...

CVE-2025-58826

CVE-2025-58826 concerns the WordPress plugin WP Publication Archive (versions up to 3.0.1). The vulnerability is an XSS (Stored) due to improper input neutralization during web page generation, allowing injected script to persist in pages generated by the plugin. The entry explicitly notes the af...

WordPress WP Publication Archive Plugin <= 3.0.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by theviper17 in WordPress Plugin WP Publication Archive versions = 3.0.1...

Django: Path traversal via archive.extract - CVE 2021-3281 incomplete patch

A vulnerability was discovered in the "extract" function of the ZipArchive and TarArchive classes in the Django framework. The vulnerability was caused by the use of the "abspath" function, which removes terminating path separators. This made the guard logic protection insufficient to protect...

CVE-2025-58826: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Eric Mann WP Publication Archive wp-publication-archive allows Stored XSS.This issue affects WP Publication Archive : from n/a through = 3.0.1...