CVE-2025-30267

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following...

CVE-2025-30270 QTS, QuTS hero

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following...

CVE-2025-58335

In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 information disclosure was possible via searchproject function...

CVE-2025-34163

Dongsheng Logistics Software exposes an unauthenticated endpoint at /CommMng/Print/UploadMailFile that fails to enforce proper file type validation and access control. An attacker can upload arbitrary files, including executable scripts such as .ashx, via a crafted multipart/form-data POST reques...

CVE-2025-34163 Dongsheng Logistics Software Unauthenticated Arbitrary File Upload

Dongsheng Logistics Software exposes an unauthenticated endpoint at /CommMng/Print/UploadMailFile that fails to enforce proper file type validation and access control. An attacker can upload arbitrary files, including executable scripts such as .ashx, via a crafted multipart/form-data POST reques...

CVE-2025-34163

Dongsheng Logistics Software exposes an unauthenticated endpoint at /CommMng/Print/UploadMailFile that fails to enforce proper file type validation and access control. An attacker can upload arbitrary files, including executable scripts such as .ashx, via a crafted multipart/form-data POST reques...

CVE-2025-34160 AnyShare ServiceAgent API Unauthenticated RCE

AnyShare contains a critical unauthenticated remote code execution vulnerability in the ServiceAgent API exposed on port 10250. The endpoint /api/ServiceAgent/startservice accepts user-supplied input via POST and fails to sanitize command-like payloads. An attacker can inject shell syntax that is...

Linux Distros Unpatched Vulnerability : CVE-2020-13962

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause a denial of service...

Linux Distros Unpatched Vulnerability : CVE-2021-27851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security vulnerability that can lead to local privilege escalation has been found in 'guix-daemon'. It affects multi-user setups in which 'guix-daemon' runs...

Adobe Commerce/Magento XXE Vulnerability (APSB24-40)

The version of Adobe Commerce/Magento Open Source installed on the remote host falls within one of the following ranges 2.4.7 2.4.7-p1 Adobe Commerce / 2.4.6 2.4.6-p6 Adobe Commerce / 2.4.5 2.4.5-p8 Adobe Commerce / 2.4.4 2.4.4-p9 Adobe Commerce / 2.4.3 2.4.3-ext-8 Adobe Commerce / 2.4.2...

ImageMagick has Undefined Behavior (function-type-mismatch) in CloneSplayTree

Summary - Target: ImageMagick commit ecc9a5eb456747374bae8e07038ba10b3d8821b3 - Type: Undefined Behavior function-type-mismatch in splay tree cloning callback - Impact: Deterministic abort under UBSan DoS in sanitizer builds. No crash in a non-sanitized build; likely low security impact. - Trigge...

CVE-2018-3180 vulnerabilities

Vulnerabilities for packages: openjdk-8-openj9, openjdk-25-openj9, openjdk-11-openj9, openjdk-17-openj9, openjdk-26-openj9, openjdk-21-openj9...

Linux Distros Unpatched Vulnerability : CVE-2025-47153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs20.19.0+dfsg-2i386.deb for Debian GNU/Linu...

Important: Red Hat Security Advisory: Red Hat OpenShift Builds 1.5.1

Red Hat OpenShift Builds 1.5.1 Releases of Red Hat OpenShift Builds 1.5.1...

Important: Red Hat Security Advisory: Red Hat OpenShift Builds 1.5.1

Red Hat OpenShift Builds 1.5.1 Releases of Red Hat OpenShift Builds 1.5.1...

Malicious code in screwdriver-plugin-builds (npm)

The package screwdriver-plugin-builds was found to contain malicious code...

MAL-2025-32825 Malicious code in screwdriver-plugin-builds (npm)

The package screwdriver-plugin-builds was found to contain malicious code...

CVE-2025-54800

Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-par...

DEBIAN-CVE-2025-55160

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior function-type-mismatch in splay tree cloning callback. This results in a deterministic abort under UBSan DoS in sanitizer builds, wit...

CVE-2025-55160 ImageMagick Undefined Behavior (function-type-mismatch) in CloneSplayTree

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior function-type-mismatch in splay tree cloning callback. This results in a deterministic abort under UBSan DoS in sanitizer builds, wit...