CVE-2025-26464

In executeAppFunction of AppSearchManagerService.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Roo Code: Operating System Command Injection Vulnerability

Roo Code is an AI-based autonomous coding agent from Roo Code. An operating system command injection vulnerability exists in Roo Code 3.25.23 and earlier versions, which stems from the npm install auto-execute script and could lead to arbitrary code execution...

SUSE-SU-2025:20655-1 Security update for jq

This update for jq fixes the following issues: - CVE-2025-48060: Fixed stack-buffer-overflow in jqfuzzexecute jvstringvfmt bsc1244116...

Security update for jq

This update for jq fixes the following issues: CVE-2025-48060: Fixed stack-buffer-overflow in jqfuzzexecute jvstringvfmt bsc1244116. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run th...

CVE-2025-38681 mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()

In the Linux kernel, the following vulnerability has been resolved: mm/ptdump: take the memory hotplug lock inside ptdumpwalkpgd Memory hot remove unmaps and tears down various kernel page table regions as required. The ptdump code can race with concurrent modifications of the kernel page tables...

arm64: set UXN on swapper page tables

...

arm64: set UXN on swapper page tables

...

CVE-2025-55474

Many Notes 0.10.1 is vulnerable to Cross Site Scripting XSS, which allows malicious Markdown files to execute JavaScript when viewed...

PT-2025-36581

A security feature bypass vulnerability exists in Windows Defender Application Control WDAC which could allow an attacker to bypass WDAC enforcement. An attacker who successfully exploited this vulnerability could execute PowerShell commands that would be blocked by WDAC. To exploit the...

GHSA-PH6W-F82W-28W6 Claude Code Vulnerable to Arbitrary Code Execution Due to Insufficient Startup Warning

When Claude Code was started in a new directory, it displayed a warning asking, "Do you trust the files in this folder?". This warning did not properly document that selecting "Yes, proceed" would allow Claude Code to execute files in the folder without additional confirmation. This may not have...

CVE-2023-21475

Out-of-bounds Write vulnerability in libaudiosaplussec.so library prior to SMR Apr-2023 Release 1 allows local attacker to execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2016-6903

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands. CVE-2016-6903 Note that Nessus relies on the...

CVE-2025-55824

ModStartCMS v9.5.0 is affected by an arbitrary file write vulnerability. This flaw enables attackers to write malicious files to the server, which can lead to the execution of malicious commands and the subsequent theft of sensitive data . The vulnerability is associated with CWE-77 (Improper Neu...

CVE-2025-55824

ModStartCMS v9.5.0 has an arbitrary file write vulnerability, which allows attackers to write malicious files and execute malicious commands to obtain sensitive data on the server...

CVE-2025-55824: Improper Neutralization of Special Elements used in a Command

ModStartCMS v9.5.0 has an arbitrary file write vulnerability, which allows attackers to write malicious files and execute malicious commands to obtain sensitive data on the server...

Ensure That the umask Value Is Correct

The umask value is the mask for default file or directory permissions. When a file or directory is created, its default permission is set to 777 minus the umask value. For a file, its execute permission is also removed. If the umask value is set improperly, the permission of new files may be too...

Malicious code in octolytics (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5d86b4c4ce77a41bee827eb614c38868e1231feef6629f9baf9cc665e472f530 The OpenSSF Package Analysis project identified 'octolytics' @ 0.19.0 rubygems as malicious. It is considered malicious because: - The package...

CVE-2025-34521

A reflected cross-site scripting XSS vulnerability exists in the web interface of the Arcserve Unified Data Protection UDP, where unsanitized user input is improperly reflected in HTTP responses. This flaw allows remote attackers with low privileges to craft malicious links that, when visited by...

CVE-2012-10062 XAMPP WebDAV PHP Upload Authentication Bypass RCE

A vulnerability in XAMPP, developed by Apache Friends, version 1.7.3's default WebDAV configuration allows remote authenticated attackers to upload and execute arbitrary PHP code. The WebDAV service, accessible via /webdav/, accepts HTTP PUT requests using default credentials. This permits...

CVE-2025-58159 WeGIA Authenticated Arbitrary File Upload Leading To Remote Code Execution (RCE)

WeGIA is a Web manager for charitable institutions. Prior to version 3.4.11, a remote code execution vulnerability was identified, caused by improper validation of uploaded files. The application allows an attacker to upload files with arbitrary filenames, including those with a .php extension...