CVE-2025-54469 NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow

A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTERRPCPORT and CLUSTERLANPORT to generate a command to be executed via popen, without first sanitising their values. The entry process of the enforcer container is the monitor process. When the enforcer...

CVE-2025-54469

NeuVector Enforcer is vulnerable to command injection due to unsanitized use of environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to compose shell commands via popen. Connected sources (GO-2025-4042, NVD/OSV entries) confirm the issue and potential impact (command injection; buffer over...

CVE-2025-62402 Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API

API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available...

CVE-2025-62402 Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API

API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available...

[SECURITY] Fedora 42 Update: qt-creator-16.0.2-3.fc42

Qt Creator is a cross-platform IDE integrated development environment tailored to the needs of Qt developers...

sqls 安全漏洞

sqls is the sqls-server open source a SQL language server written in Go. A security vulnerability exists in sqls version 0.2.28, which stems from the openEditor function not cleaning up the EDITOR environment variable and configuration file path, which could lead to a command injection attack...

Apache Airflow 安全漏洞

Apache Airflow is a set of open source platforms with the ability to create, manage and monitor workflows from the US Apache Apache Foundation. The platform is characterized by scalability and dynamic monitoring. A security vulnerability exists in Apache Airflow, which stems from the...

PT-2025-44455

Name of the Vulnerable Software and Affected Versions sqls-server/sqls version 0.2.28 Description sqls-server/sqls version 0.2.28 contains a command injection issue in the config command. The openEditor function passes the EDITOR environment variable and the config file path to sh -c without prop...

NeuVector 操作系统命令注入漏洞

NeuVector is an end-to-end container security platform from US-based NeuVector. The platform includes features such as image vulnerability management, access control, and container process/filesystem protection. NeuVector suffers from an operating system command injection vulnerability that stems...

CVE-2025-61141

sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environment variable and config file path to sh -c without sanitization, allowing attackers to execute arbitrary commands...

CVE-2023-7324

CVE-2023-7324 has concrete details in connected sources: the Linux kernel SES (scsi: ses) contains a fix for out-of-bounds accesses to addl_desc_ptr in ses_enclosure_data_process(). The vulnerability is described as sanitizing addl_desc_ptr out-of-bounds accesses, with a high impact (CVSS 8.1, ad...

Exploit for CVE-2025-55752

CVE-2025-55752: Apache Tomcat Path Traversal Vulnerability A...

Allegra 路径遍历漏洞

Allegra is a project management software for mid-sized organizations from Allegra. A path traversal vulnerability exists in Allegra that stems from a failure to properly validate a user-supplied path in the DatabaseBackupBL class, which could lead to information disclosure in a service account...

Siemens SIMATIC Devices Stack-based Buffer Overflow (CVE-2023-4911)

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBCTUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBCTUNABLES environment variables when launching binaries with SUID permission to execute code...

CVE-2025-58058 affecting package podman for versions less than 5.6.1-2

CVE-2025-58058 affecting package podman for versions less than 5.6.1-2. An upgraded version of the package is available that resolves this issue...

CVE-2025-48039 affecting package erlang for versions less than 26.2.5.15-1

CVE-2025-48039 affecting package erlang for versions less than 26.2.5.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2021-20291 affecting package buildah for versions less than 1.41.4-2

CVE-2021-20291 affecting package buildah for versions less than 1.41.4-2. An upgraded version of the package is available that resolves this issue...

CVE-2025-1118 affecting package grub2 for versions less than 2.06-25

CVE-2025-1118 affecting package grub2 for versions less than 2.06-25. A patched version of the package is available...

Exploit for Uncontrolled Search Path Element in Needrestart_Project Needrestart

CVE-2024-48990 PYTHONPATH Hijack - Privilege Escalation Exploi...

GHSA-GV8H-7V7W-R22Q Docker Compose Vulnerable to Path Traversal via OCI Artifact Layer Annotations

Docker Compose trusts the path information embedded in remote OCI compose artifacts. When a layer includes the annotations com.docker.compose.extends or com.docker.compose.envfile, Compose joins the attacker‑supplied value from com.docker.compose.file/com.docker.compose.envfile with its local cac...