USN-7651-5 linux-raspi-realtime vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - PowerPC architecture; - S390 architecture; - Block layer subsystem; - Serial ATA and Parallel ATA drivers; - Driver...

MyHeat GO API Unauthorized Access

The vulnerability of the API interface of the MyHeat GO boiler controller is related to the use of default login credentials. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to the controller by using the standard login credentials...

ABB AC500 V2 security vulnerabilities

ABB AC500 V2 is a PLC from ABB Switzerland. suitable for simple control tasks and complex automation solutions. A security vulnerability exists in ABB AC500 V2 version 2.5.2 and earlier, which stems from vulnerability to buffer over-reading attacks...

MyHeat GO API Unauthorized Access

The vulnerability of the API interface of the boiler control controller MyHeat GO is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the controller...

JHTTPD Web Server Heap Buffer Overflow DoS

The vulnerability of the upnpctrlasp function in the JHTTPD web server of the D-Link DI-8100 microprogrammed router software is related to the execution of operations outside the buffer in memory when processing the removeextproto and removeextport parameters. Exploitation of this vulnerability...

CVE-2025-47281

Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial of Service DoS vulnerability exists due to improper handling of JMESPath variable substitutions. Attackers with permissions to create or update Kyverno policies can craft...

CVE-2025-47281 Kyverno's Improper JMESPath Variable Evaluation Leads to Denial of Service

Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial of Service DoS vulnerability exists due to improper handling of JMESPath variable substitutions. Attackers with permissions to create or update Kyverno policies can craft...

CVE-2025-47281: Improper Input Validation

Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial of Service DoS vulnerability exists due to improper handling of JMESPath variable substitutions. Attackers with permissions to create or update Kyverno policies can craft...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception via improper handling of JMESPath variable substitutions in the getValueAsStringMap function within pkg/engine/wildcards/wildcards.go. An attacker can cause the admission controller and reports controller to crash by...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the downloadFile function in the ModuleController.php file, which fails to validate the query parameter file. An authenticated attacker with access to the backend module can access...

DB-GPT command injection vulnerabilities

DB-GPT is an AWEL and agent-based AI native data application development framework open-sourced by eosphoros. A security vulnerability exists in DB-GPT version 0.7.0, which stems from a file upload vulnerability in agent.hub.controller.refreshplugins that could lead to the execution of arbitrary...

CVE-2025-7936

A vulnerability has been found in fuyanglipengjun platform up to ca9aceff6902feb7b0b6bf510842aea88430796a and classified as critical. Affected by this vulnerability is the function queryPage of the file com/platform/controller/ScheduleJobLogController.java. The manipulation of the argument...

CVE-2025-7934

A vulnerability, which was classified as critical, has been found in fuyanglipengjun platform up to ca9aceff6902feb7b0b6bf510842aea88430796a. This issue affects the function queryPage of the file platform-schedule/src/main/java/com/platform/controller/ScheduleJobController.java. The manipulation ...

Weitong Mall has a vulnerability

Weitong Mall Weitong Mall is a shopping mall system by fuyanglipengjun, an individual developer. Weitong Mall has an injection vulnerability, the vulnerability stems from a SQL injection problem in the function queryPage in the file...

JPACookieShop code-related vulnerabilities

JPACookieShop is a cake mall platform software by Jerryshensjf individual developer. A code issue vulnerability exists in JPACookieShop version 1.0, which stems from an incorrect operation of the function addGoods in the file GoodsController.java resulting in unlimited uploads...

TRENDnet TEW-WLC100P security vulnerabilities

The TRENDnet TEW-WLC100P is a wireless LAN controller from Trendnet, Inc. A security vulnerability exists in the TRENDnet TEW-WLC100P version 2.03b03, which stems from enabling aggressive mode in the racoon configuration file, which could lead to an offline dictionary attack...

CVE-2025-7906 yangzongzhuan RuoYi CommonController.java uploadFile unrestricted upload

A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1 and classified as critical. This issue affects the function uploadFile of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java. The manipulation of the argument File leads to unrestricted upload. The...

ThinkGem JeeSite code issues and vulnerabilities

Thinkgem JeeSite is an open source Java EE enterprise-class rapid development platform of China Joyuan Thinkgem company . The platform includes system permissions components , data permissions components , data dictionary components , core tools components , view manipulation components , workflo...

GHSA-565H-44M8-4C2V xxl-job has Inadequate Encryption Strength

A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic. Affected by this issue is the function makeToken of the file src/main/java/com/xxl/job/admin/controller/IndexController.java of the component Token Generation. The manipulation leads to password hash with...

CVE-2025-7763

A vulnerability, which was classified as problematic, was found in thinkgem JeeSite up to 5.12.0. Affected is the function select of the file src/main/java/com/jeesite/modules/cms/web/SiteController.java of the component Site Controller. The manipulation of the argument redirect leads to open...