WordPress plugin Brevo for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

PT-2026-1742

Name of the Vulnerable Software and Affected Versions Brevo for WooCommerce versions up to and including 4.0.49 Description The Brevo for WooCommerce plugin for WordPress is susceptible to Stored Cross-Site Scripting through the user connection id parameter. Insufficient input sanitization and...

curl 安全漏洞

curl is a cURL open source tool for transferring data from or to a server. A security vulnerability exists in curl that stems from the CURLOPTPINNEDPUBLICKEY option that skips public key checking under certain conditions, which could lead to connection forgery...

Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to write

A vulnerability exists in the HTTP layer of Quarkus REST related to response handling. When a response is being written, the framework waits for previously written response chunks to be fully transmitted before proceeding. If the client connection is dropped during this waiting period, the...

EUVD-2026-1178

Quarkus is a Cloud Native, Linux Container First framework for writing Java applications. Prior to versions 3.31.0, 3.27.2, and 3.20.5, a vulnerability exists in the HTTP layer of Quarkus REST related to response handling. When a response is being written, the framework waits for previously writt...

CVE-1999-0414

In Linux before version 2.0.36, remote attackers can spoof a TCP connection and pass data to the application layer before fully establishing the connection...

CVE-1999-0770

Firewall-1 sets a long timeout for connections that begin with ACK or other packets except SYN, allowing an attacker to conduct a denial of service via a large number of connection attempts to unresponsive systems...

CVE-1999-0680

Windows NT Terminal Server performs extra work when a client opens a new connection but before it is authenticated, allowing for a denial of service...

CVE-1999-0305

The system configuration control sysctl facility in BSD based operating systems OpenBSD 2.2 and earlier, and FreeBSD 2.2.5 and earlier, does not properly restrict source routed packets even when the 1 dosourceroute or 2 forwarding variables are set, which allows remote attackers to spoof TCP...

CVE-2019-16210

Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save...

CVE-2024-2216

A missing permission check in an HTTP endpoint in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting futu...

Malicious Package

Overview qyxb is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

CVE-2025-15474

CVE-2025-15474 affects AuntyFey Smart Combination Lock firmware (as of 2025-12-24). Affected component: BLE handling in the device, where an unauthenticated attacker in BLE range can repeatedly initiate connections to cause a denial of service by interrupting keypad authentication and forcing loc...

Columbia Weather Systems MicroServer 安全漏洞

Columbia Weather Systems MicroServer is a weather data server from Columbia Weather Systems, USA. A security vulnerability exists in Columbia Weather Systems MicroServer that stems from an unused function that can initiate a reverse SSH connection, potentially resulting in the connection being...

Medium: nodejs24

Issue Overview: Use after free due to connection being cleaned up after error CVE-2025-62408 Affected Packages: nodejs24 Issue Correction: Run dnf update nodejs24 --releasever 2023.10.20260105 or dnf update --advisory ALAS2023-2025-1348 --releasever 2023.10.20260105 to update your system. More...

AuntyFey Smart Combination Lock 安全漏洞

AuntyFey Smart Combination Lock is a smart padlock from AuntyFey. AuntyFey Smart Combination Lock has a security vulnerability that originates from an attacker being able to repeatedly initiate a BLE connection, which could lead to a denial of service attack...

Efacec QC 安全漏洞

Efacec QC is a series of electric vehicle charging posts from Efacec Portugal. A security vulnerability exists in the Efacec QC 60/90/120, which originates from a network connection where an attacker could detect plaintext credentials...

Malicious Package

Overview orchestration-node-common-errors is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview oj-sp-about-page is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2025-20761

In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch...