EUVD-2023-38998

Malicious code in bioql PyPI...

EUVD-2023-3012

Malicious code in bioql PyPI...

CVE-2025-54087

CVE-2025-54087 describes a server-side request forgery in Ivanti Secure Access prior to version 14.10. The vulnerability allows administrators to publish a crafted HTTP request originating from the Secure Access server, with attack complexity high, no required user interaction beyond administrati...

BIT-MONGODB-2024-10921 Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server

An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to...

CVE-2025-54290

Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview marimo is an A library for making reactive notebooks and apps Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the /mpl/port/ endpoint, which acts as an unauthenticated proxy. An attacker can access internal services and arbitrary...

Privilege Escalation

sap/xssecis vulnerable to Privilege Escalation. The vulnerability is due to a flaw where the library can incorrectly accept or elevate security context from untrusted input, and an unauthenticated attacker can exploit this by sending specially crafted requests or tokens to obtain arbitrary...

CVE-2025-51495

CVE-2025-51495 affects the WebSocket component of Mongoose versions 7.5 through 7.17 . A vulnerability in the WebSocket handling can trigger an integer overflow when processing a specially crafted request, potentially causing the application to crash (denial of service). In cases where downstream...

Security Bulletin: IBM i is affected by denial of service vulnerabilities in IBM WebSphere Application Server Liberty [CVE-2025-36097, CVE-2025-36047, CVE-2025-48976]

Summary IBM WebSphere Application Server Liberty for IBM i is vulnerable to a denial of service by sending a specially crafted request that causes the server to consume excessive memory resources CVE-2025-36097, CVE-2025-36047 and by allocation of resources for multipart headers with insufficient...

CVE-2025-59341 Local File Inclusion in esm.sh

esm.sh is a nobuild content delivery networkCDN for modern web development. In 136 and earlier, a Local File Inclusion LFI issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem or other...

CVE-2025-57061

Tenda G3 v3.0brV15.11.0.17 was discovered to contain multiple stack overflows in the formIPMacBindModify function via the ruleId, ip, mac, v6 and remark parameters. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

IBM WebSphere Application Server Liberty 18.0.0.2 < 25.0.0.8 Denial of Service (7242086)

The version of IBM WebSphere Application Server Liberty running on the remote host is affected by a denial of service vulnerability as referenced in the 7242086 advisory: - IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a...

CVE-2025-52915

K7RKScan.sys 23.0.0.10, part of the K7 Security Anti-Malware suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that are protected through a third-party implementation. This is caused by insufficient caller validation in the driver's IOCTL handler, enabli...

CVE-2025-57060

Tenda G3 v3.0brV15.11.0.17 was discovered to contain a stack overflow in the rules parameter in the dnsforwardrulestore function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

PT-2025-36931

Name of the Vulnerable Software and Affected Versions: Tenda G3 version 3.0br V15.11.0.17 Description: The Tenda G3 version 3.0br V15.11.0.17 contains a stack overflow in the rules parameter within the dns forward rule store function. This issue allows attackers to cause a Denial of Service DoS b...

PT-2025-36787

Name of the Vulnerable Software and Affected Versions: Tenda G3 version 3.0br V15.11.0.17 Description: The Tenda G3 version 3.0br V15.11.0.17 contains multiple stack overflows in the formIPMacBindModify function. These overflows occur via the ruleId, ip, mac, v6, and remark parameters. A crafted...

PT-2025-36786

Name of the Vulnerable Software and Affected Versions: Tenda G3 version 3.0br V15.11.0.17 Description: The device contains a stack overflow in the dhcpIndex parameter within the addDhcpRule function. This issue allows attackers to cause a Denial of Service DoS through a crafted request...

CVE-2025-57057

Tenda G3 firmware v3.0br_V15.11.0.17 contains a stack/buffer overflow in the ipMacBindListStore function’s listStr parameter due to improper input length validation. This can allow an attacker to cause a Denial of Service (DoS) with a crafted request. Documented details are corroborated by multip...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to not saving the request parameters in the portlet session. An attacker can exhaust system memory by sending crafted HTTP requests. Details Denial of Service DoS describes a family of attacks, all aimed at...

CVE-2025-43772

Kaleo Forms Admin in Liferay Portal (7.0.0–7.4.3.4) and Liferay DXP (7.4 GA, 7.3 GA–update 27) is affected by a DoS due to not restricting saving of request parameters in the portlet session. The root cause is unvalidated/unrestricted storage of request data in memory, enabling remote attackers t...