PT-2026-22385

Name of the Vulnerable Software and Affected Versions calibre versions prior to 9.4.0 Description calibre is an e-book manager used for viewing, converting, editing, and cataloging e-books. The Content Server’s brute-force protection mechanism relies on a ban key derived from both the remote addr...

PT-2026-7016

Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1., 2. before 2.0.7. Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue. Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough, tha...

CVE-2025-15387 QNO Technology｜VPN Firewall - Insufficient Entropy

VPN Firewall developed by QNO Technology has a Insufficient Entropy vulnerability, allowing unauthenticated remote attackers to obtain any logged-in user session through brute-force attacks and subsequently log into the system...

CVE-2025-15387 QNO Technology｜VPN Firewall - Insufficient Entropy

VPN Firewall developed by QNO Technology has a Insufficient Entropy vulnerability, allowing unauthenticated remote attackers to obtain any logged-in user session through brute-force attacks and subsequently log into the system...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992883)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992883 advisory. In the Linux kernel, the following vulnerability has been resolved: Input: iforce - wake up after clearing IFORCEXMITRUNNING flag syzbot is reporting hung task at...

QNO VPN Firewall 安全特征问题漏洞

QNO VPN Firewall is a multi-functional security gateway from Taiwan, China-based QNO. A security signature issue vulnerability exists in QNO VPN Firewall, which stems from insufficient entropy and could allow an unauthenticated, remote attacker to gain access to a logged-in user session and log i...

PT-2025-54291

Name of the Vulnerable Software and Affected Versions QNO Technology VPN Firewall affected versions not specified Description The VPN Firewall developed by QNO Technology contains an insufficient entropy issue. This allows unauthenticated remote attackers to obtain any logged-in user session...

CVE-2025-68497

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force Astra Widgets astra-widgets allows Stored XSS.This issue affects Astra Widgets: from n/a through = 1.2.16...

SUSE CVE-2022-50771

In the Linux kernel, the following vulnerability has been resolved: rcu: Fix thiscpuread lockdep warning in rcuforcequiescentstate Running rcutorture with non-zero fqsduration module parameter in a kernel built with CONFIGPREEMPTION=y results in the following splat: BUG: using thiscpuread in...

EUVD-2022-55790

In the Linux kernel, the following vulnerability has been resolved: rcu: Fix thiscpuread lockdep warning in rcuforcequiescentstate Running rcutorture with non-zero fqsduration module parameter in a kernel built with CONFIGPREEMPTION=y results in the following splat: BUG: using thiscpuread in...

CVE-2025-68497

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force Astra Widgets astra-widgets allows Stored XSS.This issue affects Astra Widgets: from n/a through = 1.2.16...

CVE-2022-50771

In the Linux kernel, the following vulnerability has been resolved: rcu: Fix thiscpuread lockdep warning in rcuforcequiescentstate Running rcutorture with non-zero fqsduration module parameter in a kernel built with CONFIGPREEMPTION=y results in the following splat: BUG: using thiscpuread in...

📄 Litespeed Cache 6.4.0.1 Privilege Escalation

WordPress Litespeed Cache plugin version 6.4.0.1 allows attackers to brute-force authentication hashes and create administrative users without any initial credentials...

PT-2025-53077

Name of the Vulnerable Software and Affected Versions Brainstorm Force Astra Widgets versions through 1.2.16 Description A flaw exists in Brainstorm Force Astra Widgets that allows for Stored Cross-site Scripting XSS. This issue arises from improper neutralization of input during web page...

CVE-2025-34433

AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt using PHP uniqid. The installation timestamp is exposed via a public endpoint, and a derived hash identifier is accessible through...

CVE-2025-34433

AVideo 14.3.1–20.0.x isaffected by an unauthenticated RCE due to insecure salt generation: installation salt is created with PHP uniqid(), and the installation timestamp plus a derived hashId are exposed publicly, enabling offline brute-forcing of the remaining entropy to recover the salt. Attack...

CVE-2025-34433

AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt using PHP uniqid. The installation timestamp is exposed via a public endpoint, and a derived hash identifier is accessible through...

CVE-2025-67853

A flaw was found in Moodle. A remote attacker could exploit a lack of proper rate limiting in the confirmation email service. This vulnerability allows attackers to more easily enumerate or guess user credentials, facilitating brute-force attacks against user accounts...

PT-2025-52457

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 20.1 Description The software contains an unauthenticated remote code execution issue resulting from predictable generation of an installation salt using PHP uniqid. The installation timestamp is exposed via a public...

AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery

This module exploits an unauthenticated remote code execution RCE vulnerability in AVideo's notify.ffmpeg.json.php endpoint. The vulnerability stems from a critical cryptographic weakness in the salt generation mechanism combined with information disclosure vulnerabilities that allow an attacker ...