Ivanti Endpoint Manager 安全漏洞

Ivanti Endpoint Manager EPM is a set of endpoint security managers developed by the American company Ivanti. Versions of Ivanti Endpoint Manager prior to EPM 2024 SU5 contained security vulnerabilities. These vulnerabilities were due to authentication bypass vulnerabilities, which could allow...

CVE-2025-71097 affecting package kernel for versions less than 6.6.121.1-1

CVE-2025-71097 affecting package kernel for versions less than 6.6.121.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-22111 affecting package kernel for versions less than 6.6.121.1-1

CVE-2025-22111 affecting package kernel for versions less than 6.6.121.1-1. A patched version of the package is available...

CVE-2024-49968 affecting package kernel for versions less than 6.6.121.1-1

CVE-2024-49968 affecting package kernel for versions less than 6.6.121.1-1. A patched version of the package is available...

CVE-2025-13151 affecting package libtasn1 for versions less than 4.19.0-3

CVE-2025-13151 affecting package libtasn1 for versions less than 4.19.0-3. A patched version of the package is available...

CVE-2025-22107 affecting package kernel for versions less than 6.6.121.1-1

CVE-2025-22107 affecting package kernel for versions less than 6.6.121.1-1. A patched version of the package is available...

CVE-2025-71098 affecting package kernel for versions less than 6.6.121.1-1

CVE-2025-71098 affecting package kernel for versions less than 6.6.121.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-68789 affecting package kernel for versions less than 6.6.121.1-1

CVE-2025-68789 affecting package kernel for versions less than 6.6.121.1-1. A patched version of the package is available...

CVE-2026-23019 affecting package kernel for versions less than 6.6.121.1-1

CVE-2026-23019 affecting package kernel for versions less than 6.6.121.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-13151 affecting package gnutls for versions less than 3.8.3-8

CVE-2025-13151 affecting package gnutls for versions less than 3.8.3-8. A patched version of the package is available...

CVE-2025-69420 affecting package edk2 for versions less than 20240524git3e722403cd16-14

CVE-2025-69420 affecting package edk2 for versions less than 20240524git3e722403cd16-14. A patched version of the package is available...

CVE-2026-22796 affecting package edk2 for versions less than 20240524git3e722403cd16-14

CVE-2026-22796 affecting package edk2 for versions less than 20240524git3e722403cd16-14. A patched version of the package is available...

CVE-2026-25958 Cube privilege escalation via a specially crafted request

Cube is a semantic layer for building data applications. From 0.27.19 to before 1.5.13, 1.4.2, and 1.0.14, it is possible to make a specially crafted request with a valid API token that leads to privilege escalation. This vulnerability is fixed in 1.5.13, 1.4.2, and 1.0.14...

CVE-2026-25957 Cube Denial of Service (DoS) - An authenticated attacker can crash the server by sending a specially crafted request

Cube is a semantic layer for building data applications. From 1.1.17 to before 1.5.13 and 1.4.2, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. This vulnerability is fixed in 1.5.13 and 1.4.2...

CVE-2026-25957 Cube Denial of Service (DoS) - An authenticated attacker can crash the server by sending a specially crafted request

Cube is a semantic layer for building data applications. From 1.1.17 to before 1.5.13 and 1.4.2, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. This vulnerability is fixed in 1.5.13 and 1.4.2...

CVE-2026-25925 PowerDocu Affected by Remote Code Execution via Insecure Deserialization

PowerDocu contains a Windows GUI executable to perform technical documentations. Prior to 2.4.0, PowerDocu contains a critical security vulnerability in how it parses JSON files within Flow or App packages. The application blindly trusts the $type property in JSON files, allowing an attacker to...

CVE-2026-25807 Unauthenticated Remote Code Execution via P2P Sharing in ZAI-Shell

ZAI Shell is an autonomous SysOps agent designed to navigate, repair, and secure complex environments. Prior to 9.0.3, the P2P terminal sharing feature share start opens a TCP socket on port 5757 without any authentication mechanism. Any remote attacker can connect to this port using a simple...

CVE-2026-25765

Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Prior to 2.14.1, Faraday's buildexclusiveurl method in lib/faraday/connection.rb uses Ruby's URImerge to combine the connection's base URL with a user-supplied path. Per RFC 3986,...

PYSEC-2026-2195

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to 2.20.0, CORSConfig.allowedoriginsregex is constructed using a regex built from configured allowlist values and used with fullmatch for validation. Because metacharacters are not escaped, a malicious origin can match...

CVE-2026-24675

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, urbselectinterface can free the device's MS config on error but later code still dereferences it, leading to a use after free in libusbudevselectinterface. This vulnerability is fixed in 3.22.0...