@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +50 more potentially affected by unknown CVE via next-auth (>=4.0.0-beta.6, <=4.24.11)

next-auth NPM version =4.0.0-beta.6, =0.1.0, =1.9.0, =1.9.9, =0.1.0-0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =0.0.0-experimental-20251015143743, =5.6.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-NEXTAUTH-13744118...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +50 more potentially affected by unknown CVE via next-auth (>=4.0.0-beta.6, <=4.24.11)

next-auth NPM version =4.0.0-beta.6, =0.1.0, =1.9.0, =1.9.9, =0.1.0-0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =0.0.0-experimental-20251015143743, =5.6.0 and more Source cves: unknown CVE Source advisory: GHSA-5JPX-9HW9-2FX4...

@aangeles/jefeui (>=1.10.0, <=1.11.6), @aipmorg/chat (1.5.3) +57 more potentially affected by unknown CVE via next-auth (>=5.0.0-beta.3, <=5.0.0-beta.29)

next-auth NPM version =5.0.0-beta.3, =1.10.0, =1.2.0, =1.10.3, =0.1.0, =1.2.4-main.7f918ee.29, =0.0.2, =1.0.0, =0.1.6, =0.152.1, =1.0.0, =0.106.0-rc.0, =0.122.0-rc.13 - @irshadkhan-dev/pandapulse-db 0.0.1 and more Source cves: unknown CVE Source advisory: SNYK:JS-NEXTAUTH-13744118...

@aangeles/jefeui (>=1.10.0, <=1.11.6), @aipmorg/chat (1.5.3) +57 more potentially affected by unknown CVE via next-auth (>=5.0.0-beta.3, <=5.0.0-beta.29)

next-auth NPM version =5.0.0-beta.3, =1.10.0, =1.2.0, =1.10.3, =0.1.0, =1.2.4-main.7f918ee.29, =0.0.2, =1.0.0, =0.1.6, =0.152.1, =1.0.0, =0.106.0-rc.0, =0.122.0-rc.13 - @irshadkhan-dev/pandapulse-db 0.0.1 and more Source cves: unknown CVE Source advisory: GHSA-5JPX-9HW9-2FX4...

CVE-2025-12342

A flaw has been found in Serdar Bayram Ghost Hot Spot up to 20251014. The affected element is an unknown function of the file /Auth.php of the component Login. This manipulation causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used...

aa-rag (>=0.4.2, <=0.4.3), ab-auth-client-service (>=0.1.3, <=0.3.5) +1608 more potentially affected by CVE-2025-62727 via starlette (>=0.39.2, <=0.48.0)

starlette PYPI version =0.39.2, =0.4.2, =0.1.3, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.1, =0.1.0, =0.1.1, =0.1.1, =0.1.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.3 and more Source cves: CVE-2025-62727 Source advisory: GHSA-7F5H-V6XP-FCQ8...

de.adorsys.keycloak:keycloak-clientregistration-provider (>=1.2, <=3.0), de.adorsys.keycloak:keycloak-provider-extension (>=1.2, <=3.0) +8 more potentially affected by CVE-2025-12390 via org.keycloak:keycloak-services (3.4.3.final)

org.keycloak:keycloak-services MAVEN version 3.4.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.keycloak:keycloak-clientregistration-provider =1.2, =1.2, =0.0.1, =0.0.1, =0.0.1,...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.0.beta2), org.keycloak:keycloak-account-freemarker (1.0-beta-4) +3 more potentially affected by CVE-2025-12390 via org.keycloak:keycloak-services (1.0-beta-4)

org.keycloak:keycloak-services MAVEN version 1.0-beta-4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.0.beta2 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=0.11.0, <=1.0.0.beta1), org.keycloak:keycloak-account-freemarker (1.0-beta-3) +1 more potentially affected by CVE-2025-12390 via org.keycloak:keycloak-services (1.0-beta-3)

org.keycloak:keycloak-services MAVEN version 1.0-beta-3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =0.11.0, =1.0.0.beta1 -...

CVE-2025-12342 Serdar Bayram Ghost Hot Spot Login Auth.php sql injection

A flaw has been found in Serdar Bayram Ghost Hot Spot up to 20251014. The affected element is an unknown function of the file /Auth.php of the component Login. This manipulation causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used...

CVE-2025-12342 Serdar Bayram Ghost Hot Spot Login Auth.php sql injection

A flaw has been found in Serdar Bayram Ghost Hot Spot up to 20251014. The affected element is an unknown function of the file /Auth.php of the component Login. This manipulation causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used...

EUVD-2025-36389

A flaw has been found in Serdar Bayram Ghost Hot Spot up to 20251014. The affected element is an unknown function of the file /Auth.php of the component Login. This manipulation causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used...

Adobe Experience Manager Forms - Insecure Deserialization

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user...

Serdar Bayram Ghost Hot Spot SQL Injection Vulnerability

Serdar Bayram Ghost Hot Spot is a Portal Authentication System software by Serdar Bayram Individual Developer. A SQL injection vulnerability exists in Serdar Bayram Ghost Hot Spot 20251014 and earlier versions, which stems from a SQL injection vulnerability in the component Login in the file...

Siemens SIMATIC Devices NULL Pointer Dereference (CVE-2025-21638)

In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: authenable: avoid using current-nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inconsistency: getting info from the...

Important: sssd

Issue Overview: A flaw was found in the integration of Active Directory and the System Security Services Daemon SSSD on Linux systems. In default configurations, SSSD does not enable the Kerberos local authentication plugin sssdkrb5localauthplugin, allowing an attacker with permission to modify...

CVE-2025-12266: Improper Control of Generation of Code

A vulnerability was detected in Zytec Dalian Zhuoyun Technology Central Authentication Service up to 20251009. This vulnerability affects the function empty of the file /index.php/auth/widget. Performing manipulation of the argument get.layer/get.widget/get.action results in code injection. The...

writeups

Hi there! This is a repo containing some of my security writeup...

CVE-2025-62169

OctoPrint-SpoolManager is a plugin for managing spools and all their usage metadata. In versions 1.8.0a2 and older of the testing branch and versions 1.7.7 and older of the stable branch, the APIs of the OctoPrint-SpoolManager plugin do not correctly enforce authentication or authorization checks...

OESA-2025-2514 sssd security update

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...