CVE-2025-51966

A cross-site scripting XSS vulnerability exists in the PDF preview functionality of uTools thru 7.1.1. When a user previews a specially crafted PDF file, embedded JavaScript code executes within the application's privileged context, potentially allowing attackers to steal sensitive data or perfor...

PT-2025-35592

Name of the Vulnerable Software and Affected Versions: uTools versions through 7.1.1 Description: A cross-site scripting XSS issue exists in the PDF preview functionality. When a user previews a specially crafted PDF file, embedded JavaScript code executes within the application’s privileged...

CVE-2025-51966

CVE-2025-51966 describes an XSS in uTools up to version 7.1.1, specifically in the PDF preview feature. The vulnerability arises when previews of specially crafted PDF files cause embedded JavaScript to execute within the application's privileged context, potentially enabling data theft or unauth...

The vulnerability of the nfs_get_lock_context function in the Linux operating system, which allows a hacker to trigger a service failure

The vulnerability of the nfsgetlockcontext function in the Linux operating system’s kernel is related to a pointer arithmetic error. Exploiting this vulnerability could allow an attacker to cause service interruptions...

CVE-2025-9607

A flaw has been found in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /module/TabelaArredondamento/view of the component Tabelas de Arredondamento Page. Executing manipulation of the argument ID can lead to sql injection. The attack may be...

Linux Distros Unpatched Vulnerability : CVE-2025-38522

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: sched/ext: Prevent updatelockedrq calls with NULL rq Avoid invoking updatelockedrq when the...

Linux Distros Unpatched Vulnerability : CVE-2025-38611

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vmci: Prevent the dispatching of uninitialized payloads The reproducer executes the host's unlockedioctl call in two different tasks. When initcontext fails, th...

Linux Distros Unpatched Vulnerability : CVE-2025-38591

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reject narrower access to pointer ctx fields The following BPF program, simplified from a syzkaller repro, causes a kernel warning: r0 = u8 r1 + 169...

Linux Distros Unpatched Vulnerability : CVE-2025-38549

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix memory leak of efivarfsfsinfo in fscontext error paths When processing mount...

CVE-2025-34521

A reflected cross-site scripting XSS vulnerability exists in the web interface of the Arcserve Unified Data Protection UDP, where unsanitized user input is improperly reflected in HTTP responses. This flaw allows remote attackers with low privileges to craft malicious links that, when visited by...

Linux Distros Unpatched Vulnerability : CVE-2023-51847

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in obgm and Libcoap v.a3ed466 allows a remote attacker to cause a denial of service via thecoapcontextt function in the src/coapthreadsafe.c:297:3...

Linux Distros Unpatched Vulnerability : CVE-2021-33480

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An use-after-free vulnerability was discovered in gocr through 0.53-20200802 in contextcorrection in pgm2asc.c. CVE-2021-33480 Note that Nessus relies on the...

Linux Distros Unpatched Vulnerability : CVE-2021-40826

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Clementine Music Player through 1.3.1 is vulnerable to a User Mode Write Access Violation, affecting the MP3 file parsing functionality at clementine+0x3aa207...

CVE-2025-48979

A flaw was found in uisp. Improper input validation allows a command injection vulnerability, enabling a local attacker with high privileges to execute arbitrary commands. This exploitation occurs through crafted input to the application. The consequence of successful exploitation is limited to...

MCP SSH Agent 安全漏洞

MCP SSH Agent is an open source Model Context Protocol server for managing and controlling SSH connections from Aionda GmbH. A security vulnerability exists in MCP SSH Agent version 1.0.3 and earlier, which stems from a command injection in the file server-simple.mjs...

CVE-2025-56236

FormCms v0.5.5 contains a stored XSS vulnerability in the avatar upload endpoint (/api/profile/avatar). An authenticated attacker can upload a malicious .html file that is publicly accessible; when a privileged user opens the URL, the script executes in their browser context. Several sources (Ver...

CVE-2025-34521

A reflected cross-site scripting XSS vulnerability exists in the web interface of the Arcserve Unified Data Protection UDP, where unsanitized user input is improperly reflected in HTTP responses. This flaw allows remote attackers with low privileges to craft malicious links that, when visited by...

CVE-2025-34521 Arcserve UDP < 10.2 Reflected Cross-Site Scripting (XSS)

A reflected cross-site scripting XSS vulnerability exists in the web interface of the Arcserve Unified Data Protection UDP, where unsanitized user input is improperly reflected in HTTP responses. This flaw allows remote attackers with low privileges to craft malicious links that, when visited by...

CVE-2025-34157

CVE-2025-34157 concerns Coolify. A stored XSS in the project-creation workflow affects versions prior to 4.0.0-beta.420.6. An authenticated user with low privileges can craft a project name containing JavaScript, which when an administrator deletes the project executes in the admin context, enabl...

Anthropic Disrupts AI-Powered Cyberattacks Automating Theft and Extortion Across Critical Sectors

Anthropic on Wednesday revealed that it disrupted a sophisticated operation that weaponized its artificial intelligence AI-powered chatbot Claude to conduct large-scale theft and extortion of personal data in July 2025. "The actor targeted at least 17 distinct organizations, including in...