K000152924: Apache HTTP Server vulnerability CVE-2024-43204

Security Advisory Description SSRF in Apache HTTP Server with modproxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker. Requires an unlikely configuration where modheaders is configured to modify the Content-Type request or response header with a valu...

GHSA-XP75-R577-CVHP Privileged OpenBao Operator May Execute Code on the Underlying Host

Impact Under certain threat models, OpenBao operators with privileged API access may not be system administrators and thus normally lack the ability to update binaries or execute code on the system. Additionally, privileged API operators should be unable to perform TCP connections to arbitrary...

GHSA-8QF3-X8V5-2PJ8 uv allows ZIP payload obfuscation through parsing differentials

Impact In versions 0.8.5 and earlier of uv, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. This enabled two parser differentials against other Python package installers: 1. An attacker could contrive a ZIP...

CVE-2025-32430

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-3 through 16.4.7, 16.5.0-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, two templates contain reflected XSS vulnerabilities, allowing an attacker to execute...

EDK2 SMM MCE Enablement Issue

Summary A researcher reported a bug in the open source EDK2 system management interrupt SMI entry code when an MCE occurs near the start of the SMI handler. An attacker who can inject a machine check exception MCE could cause execution to jump to an attacker-controlled interrupt handler, leading ...

CVE-2025-32430

CVE-2025-32430 – XWiki Platform Reflected XSS . Affected: XWiki Platform versions 4.2-milestone-3 through 16.4.7, 16.5.0-rc-1 through 16.10.5, and 17.0.0-rc-1 through 17.2.2. Issue: two templates contain reflected XSS allowing attacker-controlled URLs to execute JavaScript in the victim’s session...

CVE-2025-54132

CVE-2025-54132 affects Cursor’s Mermaid-based diagram tool prior to version 1.3. An attacker can trigger prompt injections to cause Mermaid-rendered images to fetch data to a remote attacker-controlled server, enabling exfiltration of sensitive information. The issue is fixed in version 1.3; upgr...

CVE-2025-50477

A URL redirection in lbry-desktop v0.53.9 allows attackers to redirect victim users to attacker-controlled pages...

CVE-2025-44109

A URL redirection in Pinokio v3.6.23 allows attackers to redirect victim users to attacker-controlled pages...

CVE-2025-44109

A URL redirection in Pinokio v3.6.23 allows attackers to redirect victim users to attacker-controlled pages...

CVE-2025-50477

A URL redirection in lbry-desktop v0.53.9 allows attackers to redirect victim users to attacker-controlled pages...

CVE-2025-44109

A URL redirection vulnerability exists in Pinokio version 3.6.23 , a native AI application automation tool. This flaw allows attackers to redirect victim users to attacker-controlled pages . Remediation involves updating Pinokio to a newer version that addresses this issue. Exploitation details a...

CVE-2025-44109: URL Redirection to Untrusted Site

A URL redirection in Pinokio v3.6.23 allows attackers to redirect victim users to attacker-controlled pages...

CVE-2025-50477: URL Redirection to Untrusted Site

A URL redirection in lbry-desktop v0.53.9 allows attackers to redirect victim users to attacker-controlled pages...

CVE-2025-50477

A URL redirection in lbry-desktop v0.53.9 allows attackers to redirect victim users to attacker-controlled pages...

CVE-2025-50477

The wallet application lbry-desktop version v0.53.9 contains a URL redirection vulnerability (CWE-601). This flaw allows an attacker to redirect victim users to attacker-controlled pages . While a proof of concept (PoC) exists, specific details regarding the exploit vector or exploitation in the ...

CVE-2025-44109

A URL redirection in Pinokio v3.6.23 allows attackers to redirect victim users to attacker-controlled pages...

CVE-2025-50477

A URL redirection in lbry-desktop v0.53.9 allows attackers to redirect victim users to attacker-controlled pages...

Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering

Summary A remote script-inclusion / stored XSS vulnerability in @nuxtjs/mdc lets a Markdown author inject a element. The tag rewrites how all subsequent relative URLs are resolved, so an attacker can make the page load scripts, styles, or images from an external, attacker-controlled origin and...

CVE-2025-54075

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to version 0.17.2, a remote script-inclusion / stored cross-site scripting vulnerability in @nuxtjs/mdc lets a Markdown author inject a element. The tag rewrites how all subsequent relative...