31512 matches found
Uncontrolled Search Path Element
Overview tensorflow is a machine learning framework. Affected versions of this package are vulnerable to Uncontrolled Search Path Element via the loading of HDF5 plugins in the Keras engine. An attacker can execute arbitrary code by placing a malicious plugin in the default search path. Remediati...
DHS Wants a Single Search Engine to Flag Faces and Fingerprints Across Agencies
Homeland Security aims to combine its face and fingerprint systems into one big biometric platform—after dismantling centralized privacy reviews and key limits on face recognition...
Inside the Fix: Analysis of In-the-Wild Exploit of CVE-2026-21513
Read how PatchDiff-AI uncovered the root cause of CVE-2026-21513 — an actively exploited MSHTML vulnerability — and how APT28 leveraged it in real-world attacks...
CVE-2025-12107
Due to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute arbitrary template syntax within server-side templates. Successful exploitation of this vulnerability could allow a malicious actor with admin privilege to inject and...
@ir-engine/server-core (1.6.0), @ir-engine/taskserver (1.6.0) +4 more potentially affected by CVE-2026-27193 via @feathersjs/authentication-oauth (>=5.0.0-pre.10, <=5.0.12)
@feathersjs/authentication-oauth NPM version =5.0.0-pre.10, =2.0.4, =0.5.0, =0.5.4, =0.0.1, =2.0.4 Source cves: CVE-2026-27193 Source advisory: OSV:GHSA-9M9C-VPV5-9G85...
@ir-engine/server-core (1.6.0), @ir-engine/taskserver (1.6.0) +4 more potentially affected by CVE-2026-27193 via @feathersjs/authentication-oauth (>=5.0.0-pre.10, <=5.0.12)
@feathersjs/authentication-oauth NPM version =5.0.0-pre.10, =2.0.4, =0.5.0, =0.5.4, =0.0.1, =2.0.4 Source cves: CVE-2026-27193 Source advisory: SNYK:JS-FEATHERSJSAUTHENTICATIONOAUTH-15325870...
@ir-engine/server-core (1.6.0), @ir-engine/taskserver (1.6.0) +4 more potentially affected by CVE-2026-27192 via @feathersjs/authentication-oauth (>=5.0.0-pre.10, <=5.0.12)
@feathersjs/authentication-oauth NPM version =5.0.0-pre.10, =2.0.4, =0.5.0, =0.5.4, =0.0.1, =2.0.4 Source cves: CVE-2026-27192 Source advisory: OSV:GHSA-MP4X-C34X-WV3X...
@ir-engine/server-core (1.6.0), @ir-engine/taskserver (1.6.0) +4 more potentially affected by CVE-2026-27191 via @feathersjs/authentication-oauth (>=5.0.0-pre.10, <=5.0.12)
@feathersjs/authentication-oauth NPM version =5.0.0-pre.10, =2.0.4, =0.5.0, =0.5.4, =0.0.1, =2.0.4 Source cves: CVE-2026-27191 Source advisory: SNYK:JS-FEATHERSJSAUTHENTICATIONOAUTH-15325872...
@ir-engine/server-core (1.6.0), @ir-engine/taskserver (1.6.0) +4 more potentially affected by CVE-2026-27191 via @feathersjs/authentication-oauth (>=5.0.0-pre.10, <=5.0.12)
@feathersjs/authentication-oauth NPM version =5.0.0-pre.10, =2.0.4, =0.5.0, =0.5.4, =0.0.1, =2.0.4 Source cves: CVE-2026-27191 Source advisory: OSV:GHSA-PPF9-4FFW-HH4P...
USN-8033-8 linux-intel-iotg vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Nios II architecture; - Sun Sparc architecture; - User-Mode Linux UML; - x86 architecture; - Block layer subsystem;...
CVE-2025-12107
The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-controlled input. This allows an authenticated administrator to inject arbitrary template syntax. Successful exploitation enables an attacker...
USN-8033-7 linux-intel-iotg-5.15, linux-xilinx-zynqmp vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Nios II architecture; - Sun Sparc architecture; - User-Mode Linux UML; - x86 architecture; - Block layer subsystem;...
USN-8033-7: Linux kernel vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Nios II architecture; - Sun Sparc architecture; - User-Mode Linux UML; - x86 architecture; - Block layer subsystem;...
CVE-2025-12107
CVE-2025-12107 is linked to a server-side template injection (SSTI) vulnerability in a vulnerable third-party Velocity template engine used by WSO2 Identity Server. An attacker with administrative privileges can inject and execute arbitrary template code on the server, potentially leading to remo...
CVE-2025-12107 Server-Side Template Injection via Velocity Template Engine in Multiple WSO2 Products Allows Remote Code Execution
The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-controlled input. This allows an authenticated administrator to inject arbitrary template syntax. Successful exploitation enables an attacker...
CVE-2025-12107
Due to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute arbitrary template syntax within server-side templates. Successful exploitation of this vulnerability could allow a malicious actor with admin privilege to inject and...
PT-2026-20796
Name of the Vulnerable Software and Affected Versions versions prior to Feb. 19, 2026 Description A security flaw exists due to the use of a vulnerable third-party Velocity template engine. An attacker with administrative privileges can inject malicious template syntax, potentially leading to...
WSO2 Identity Server 安全漏洞
WSO2 Identity Server is an identity authentication server developed by the American company WSO2. WSO2 Identity Server has a security vulnerability that stems from the use of a vulnerable third-party Velocity template engine. This vulnerability could allow attackers with administrative privileges...
