40675 matches found
JLSEC-2025-83 An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5
An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free...
[SECURITY] [DLA 4337-1] svgpp security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4337-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz October 17, 2025 https://wiki.debian.org/LTS -...
OESA-2025-2482 poppler security update
is a PDF rendering library. Security Fixes: Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata such as GTSPDFEVersion of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in...
@aem-screens/franklin-variation-creator (1.0.0-B001), @akord/ui (>=3.4.1, <=3.15.4) +181 more potentially affected by CVE-2025-11849 via mammoth (>=0.3.33, <=1.10.0)
mammoth NPM version =0.3.33, =3.4.1, =0.0.1, =1.0.0, =0.0.9, =0.1.5, =1.2.1, =1.4.2, =1.0.34, =1.2.1-a, =1.0.0, =1.2.2, =0.0.7, =0.2.5 and more Source cves: CVE-2025-11849 Source advisory: OSV:GHSA-RMJR-87WV-GF87...
Mammoth is vulnerable to Directory Traversal
Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of...
SigningHub 安全漏洞
SigningHub is an electronic signature platform from SigningHub UK. A security vulnerability exists in SigningHub version v8.6.8, which stems from allowing the upload of specially crafted PDF files and could lead to the execution of arbitrary code...
PT-2025-42581
Name of the Vulnerable Software and Affected Versions mammoth versions 0.3.25 through 1.10.9 mammoth versions prior to 1.11.0 org.zwobble.mammoth:mammoth versions 0.3.25 through 1.10.9 org.zwobble.mammoth:mammoth versions prior to 1.11.0 Description The mammoth library is susceptible to a Directo...
SUSE CVE-2025-11731
A flaw was found in the exsltFuncResultComp function of libxslt, which handles EXSLT elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads...
CVE-2025-11896
In Xpdf 4.05 and earlier, a PDF object loop in a CMap, via the "UseCMap" entry, leads to infinite recursion and a stack overflow...
EUVD-2025-34835
A vulnerability was identified in NucleoidAI Nucleoid up to 0.7.10. The impacted element is the function extension.apply of the file /src/cluster.ts of the component Outbound Request Handler. Such manipulation of the argument https/ip/port/path/headers leads to server-side request forgery. The...
PT-2025-42484
Name of the Vulnerable Software and Affected Versions Strapi versions 5.0.0 through 5.5.1 Description Strapi is an open-source headless content management system. A flaw in the document service lookup does not properly sanitize query parameters for private fields. This allows an attacker to acces...
CVE-2024-56143: Authorization Bypass Through User-Controlled Key
Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does not properly sanitize query parameters for private fields. An attacker can access private fields, including admin passwords and reset...
EUVD-2025-34679
go-witness is Vulnerable to Improper Verification of AWS EC2 Identity Documents...
GHSA-72C7-4G63-HPW5 go-witness is Vulnerable to Improper Verification of AWS EC2 Identity Documents
Impact This vulnerability only affects users of the AWS attestor. Users of the AWS attestor could have unknowingly received a forged identity document. While this may seem unlikely, AWS recently issued a security bulletin about IMDS Instance Metadata Service impersonation.^1 There are multiple...
EUVD-2025-34687
Creative Cloud Desktop versions 6.7.0.278 and earlier are affected by a Time-of-check Time-of-use TOCTOU Race Condition vulnerability that could lead to arbitrary file system write. A low-privileged attacker could exploit the timing between the check and use of a resource, potentially allowing...
EUVD-2025-34690
Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, which might allow escalation of privilege. HP is releasing updated audio packages to mitigate the potential vulnerabilities...
EUVD-2025-34688
Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, which might allow escalation of privilege. HP is releasing updated audio packages to mitigate the potential vulnerabilities...
EUVD-2025-34689
When a BIG IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
EUVD-2025-34691
When IPsec is configured on the BIG-IP system, undisclosed traffic can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...