Server-side Request Forgery (SSRF)

Overview ip is a Node library. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the ip.isPublic and ip.isPrivate functions. An attacker can interact with internal network resources by supplying specially crafted IP address such as octal localhost format...

PT-2025-37918

Name of the Vulnerable Software and Affected Versions: Sparkle versions prior to 2.7.2 Description: The Sparkle framework’s Autoupdate tool lacks authentication for connecting clients. This allows a local, unprivileged attacker to request the installation of a crafted malicious PKG file, leading ...

CVE-2025-59154

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a vulnerability in how it extracts user identities from X.509 certificates. Instead of parsing the structured ASN.1 data, the code calls...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection in the filterKeyword function of the Blacklist Handler process in /com/ruoyi/generator/controller. An attacker can access or modify sensitive data, or disrupt application functionality by injecting malicious SQL statements...

CVE-2025-58177 n8n stored cross-site scripting in LangChain Chat Trigger node initialMessages parameter

n8n is an open source workflow automation platform. From 1.24.0 to before 1.107.0, there is a stored cross-site scripting XSS vulnerability in @n8n/n8n-nodes-langchain.chatTrigger. An authorized user can configure the LangChain Chat Trigger node with malicious JavaScript in the initialMessages...

Arbitrary Command Injection

Overview mcp-kubernetes-server is a The mcp-kubernetes-server is a Model Context Protocol MCP server that enables AI assistants to interact with Kubernetes clusters. It serves as a bridge between AI tools like Claude, Cursor, and GitHub Copilot and Kubernetes, translating natural language request...

Debian dsa-6001 : libcjson-dev - security update

The remote Debian 12 / 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6001 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6001-1 [email protected] https://www.debian.org/security/...

Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's removelanguagecode method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from...

[SECURITY] [DSA 5998-1] cups security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5998-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 11, 2025 https://www.debian.org/security/faq -...

CVE-2025-59047 matrix-sdk-base has panic in the `RoomMember::normalized_power_level()` method

matrix-sdk-base is the base component to build a Matrix client library. In matrix-sdk-base before 0.14.1, calling the RoomMember::normalizedpowerlevel method can cause a panic if a room member has a power level of Int::Min. The issue is fixed in matrix-sdk-base 0.14.1. The affected method isn’t...

WordPress CatFolders plugin <= 2.5.2 - Authenticated (Author+) SQL Injection via CSV Import vulnerability

Authenticated Author+ SQL Injection via CSV Import vulnerability discovered by SnailSploit in WordPress Plugin CatFolders versions = 2.5.2...

CVE-2025-6088 Improper Authorization in danny-avila/librechat

In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conversations if the conversation ID is known. Although UUIDv4 conversation IDs are generated server-side and are difficult to brute force, they...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the SelectListPage function in modules/system/dao/SysRoleDao.go. An attacker can access or modify sensitive data, or disrupt application functionality by injecting malicious SQL code through the sortName argument...

Race Condition

Overview @nguniversal/common is an Angular Universal module that is common across server-side rendering app irrespective of the rendering engine Affected versions of this package are vulnerable to Race Condition between multiple concurrent requests in the global platform injector, when using the...

CVE-2025-58764 Claude Code rg command had Command Injection that allowed bypass of user approval prompt for command execution

Claude Code is an agentic coding tool. Due to an error in command parsing, versions prior to 1.0.105 were vulnerable to a bypass of the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claud...

Linux Distros Unpatched Vulnerability : CVE-2023-1299

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Nomad and Nomad Enterprise 1.5.0 allow a job submitter to escalate to management-level privileges using workload identity and task API. Fixed in 1.5.1...

WordPress Compress Then Upload plugin < 1.0.5 - Admin+ Arbitrary File Upload vulnerability

Admin+ Arbitrary File Upload vulnerability discovered by Muhammed Çelik in WordPress Plugin Compress Then Upload versions 1.0.5...

Improper Input Validation

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Improper Input Validation in the authentication process. An attacker can gain unauthorized access to user sessions by submitting crafted input,...

Improper Input Validation

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Input Validation in the authentication process. An attacker can gain unauthorized access to user sessions by submitting crafted input, potentially leading to sessi...

CVE-2025-10095

CVE-2025-10095 affects the SMSEagle firmware in the SMPP server component. The issue arises from improper sanitization of user input in the SMPP server scripts during database interactions, and is limited to the SMPP server’s dedicated database. The vulnerability’s impact is described as a SQL in...