3713 matches found
CVE-2025-53908
RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the /api/raw endpoint. Anyone running the latest version of RomM and has multiple users, even unprivileged users, such as the kiosk user in the official...
Preventing Zero-Click AI Threats: Insights from EchoLeak
A zero-click exploit called EchoLeak reveals how AI assistants like Microsoft 365 Copilot can be manipulated to leak sensitive data without user interaction. This entry breaks down how the attack works, why it matters, and what defenses are available to proactively mitigate this emerging AI-nativ...
Indico 安全漏洞
Indico is a feature-rich event management system from Indico Open Source. A security vulnerability exists in Indico versions prior to 3.3.7, which stems from Flask-Multipass having user details leaked...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal via a two-step extraction process involving a crafted symlink and a subsequent archive containing a relative path that targets a critical file. An attacker can overwrite files outside the intended extraction director...
OESA-2025-1766 etcd security update
%expand: Security Fixes: Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.CVE-2025-4673...
McDonald’s AI Hiring Tool McHire Security Flaw Exposed Candidate Chat Data
Major security flaw in McDonald's McHire platform exposed 64M job applications. Discover how an IDOR vulnerability and weak…...
McDonald’s AI bot spills data on job applicants
McDonald's has outsourced the initial stages of its hiring process to an AI chatbot which seems to have been built without proper security measures. Security researchers managed to extract personal information about McDonald's job applicants by simply guessing a username and the password “12345.”...
Amazon Linux 2023 : oci-add-hooks (ALAS2023-2025-1079)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1079 advisory. Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which a...
EulerOS 2.0 SP10 : grub2 (EulerOS-SA-2025-1799)
According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in command/gpg. In some scenarios, hooks created by loaded modules are not removed when the related module is unloaded. This flaw...
Advantech iView 跨站脚本漏洞
Advantech iView is a Simple Network Protocol SNMP based software from Advantech, China to manage B + B SmartWorx devices. A cross-site scripting vulnerability exists in Advantech iView due to improper validation of user-supplied input. An attacker could use this vulnerability to execute...
Medium: containerd
Issue Overview: Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information. CVE-2025-4673 Affected Packages: containerd Note: This advisory is applicable to Amazon Linux 2 - Docker Extra. Visit this page to learn more about...
Medium: oci-add-hooks
Issue Overview: Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information. CVE-2025-4673 Affected Packages: oci-add-hooks Note: This advisory is applicable to Amazon Linux 2 - Docker Extra. Visit this page to learn more about...
USN-7625-1 onionshare vulnerabilities
It was discovered that OnionShare could be exploited when run with the --debug argument. A local attacker could possibly use this issue to access sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. CVE-2018-19960 It was discovered that OnionShare could be blocke...
SatanLock Ransomware Ends Operations, Says Stolen Data Will Be Leaked
SatanLock ransomware gang shuts down after weeks of attacks and plans to leak stolen victim data. Group linked to Babuk-Bjorka and GD Lockersec families...
webkitgtk: Out-of-bounds read leads to sensitive data leak
A flaw was found in WebKitGTK. Processing malicious web content may cause an out-of-bounds read due to an improper input validation, resulting in sensitive content leaking...
webkitgtk: Logic issue leading to leak of sensitive user information
A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. A malicious application may be able to leak sensitive user information...
CVE-2025-49588 Linkwarden Local File Inclusion Vulnerability
Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In version 2.10.2, the server accepts links of format file:///etc/passwd and doesn't do any validation before sending them to parsers and playwright, this can result in leak of other...
RHEL 9 : xorg-x11-server-Xwayland (RHSA-2025:10258)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:10258 advisory. Xwayland is an X server for running X clients under Wayland. Security Fixes: xorg-x11-server-Xwayland: xorg-x11-server: tigervnc:...
CVE-2025-52901
File Browser (filebrowser) vulnerability CVE-2025-52901 allows leakage of JWT session tokens via GET parameters in URLs, enabling attackers with access to a user’s URL history/logs to gain full access to the user’s account and sensitive files. The issue affects versions prior to 2.33.9 and has be...
