Cross-site Scripting (XSS)

Overview panel is a The powerful data exploration & web app framework for Python. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to missing HTML escaping in authentication templates. The errormessage variable in the basiclogin.html template and the error/errormsg...

SWIFT 安全漏洞

SWIFT is a large model and multimodal large model fine-tuning deployment framework from ModelScope open source. A security vulnerability exists in SWIFT 2.6.1 and earlier versions, which stems from the deserialization of untrustworthy data by the loadmodelmeta function in the ModelFileSystemCache...

The vulnerability of the device management platform for heating, ventilation, and air conditioning systems, lighting, and energy consumption within the Niagara Framework, along with the Niagara Enterprise Security tools for access control and security, stems from incorrect processing of alternative data streams. This allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the device management platform for heating, ventilation, and air conditioning systems, lighting, and energy consumption in the Niagara Framework, along with the access control and security measures, is related to incorrect handling of alternative data streams. Exploiting this...

PT-2025-32188

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The Android Framework component contains a flaw in access control. Exploitation of this issue may allow an attacker to escalate privileges. A race condition in multiple locations may allow...

The vulnerability of the Mobile Security Framework (MobSF), which stems from the lack of protective measures for website structures, allows attackers to carry out cross-site scripting attacks.

The vulnerability of the Mobile Security Framework for mobile application security research relates to the lack of protective measures for website structures. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

The vulnerability of the device management platform for systems related to heating, ventilation, and air conditioning, lighting, and energy consumption within the Niagara Framework, as well as the Niagara Enterprise Security tools for access control and security, stems from the absence of necessary encryption steps. This allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the device management platform for systems for heating, ventilation, and air conditioning, lighting, and energy consumption, as well as the Niagara Framework and the access control and security measures, is related to the absence of the necessary encryption step. Exploiting...

SWIFT 安全漏洞

SWIFT is a large model and multimodal large model fine-tuning deployment framework from ModelScope open source. A security vulnerability exists in SWIFT version 3.3.0, which stems from an unsafe deserialization of yaml.load in the PyYAML library, which could lead to arbitrary code execution...

The vulnerability of the device management platform for systems related to heating, ventilation, and air conditioning, lighting, and energy consumption within the Niagara Framework, as well as the Niagara Enterprise Security tools for access control and security, stems from the ability to disclose information through a query string, allowing attackers to compromise the confidentiality of protected information.

The vulnerability of the device management platform for heating, ventilation, and air conditioning systems, lighting, and energy consumption, as well as the Niagara Framework and its access control and security measures, is related to the disclosure of information through query strings. Exploitin...

PT-2025-31707

Name of the Vulnerable Software and Affected Versions: @nestjs/devtools-integration versions 0.2.0 and below Description: A critical Remote Code Execution RCE vulnerability exists in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with a...

LDAP Update Object

This module allows creating, reading, updating and deleting attributes of LDAP objects. Users can specify the object and must specify a corresponding attribute. Module Options msf use auxiliary/admin/ldap/ldapobjectattribute msf auxiliaryldapobjectattribute show actions ...actions... msf...

WordPress Beyot Framework plugin <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Settings Updates vulnerability

Missing Authorization to Authenticated Subscriber+ Settings Updates vulnerability discovered by Lucio Sá in WordPress Plugin Beyot Framework versions = 6.0.6...

WordPress Beyot Framework plugin <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

Missing Authorization to Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Lucio Sá in WordPress Plugin Beyot Framework versions = 6.0.6...

WordPress Benaa Framework plugin <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

Missing Authorization to Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Lucio Sá in WordPress Plugin Benaa Framework versions = 4.0.0...

WordPress Beyot Framework plugin <= 6.0.6 - Authenticated (Subscriber+) Arbitrary File Upload

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Lucio Sá in WordPress Plugin Beyot Framework versions = 6.0.6...

WordPress April Framework plugin <= 5.1 - Missing Authorization to Authenticated (Subscriber+) Settings Updates vulnerability

Missing Authorization to Authenticated Subscriber+ Settings Updates vulnerability discovered by Lucio Sá in WordPress Plugin April Framework versions = 5.1...

ROS-20250731-05

A vulnerability in the Moby open source container framework is related to uncontrolled resource consumption. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

The vulnerability of the Sparkle framework on the Oracle Java SE software platform arises from the ability to expose files or directories to external parties. This allows a perpetrator to bypass the signature verification mechanism and gain full control over the application.

The vulnerability of the Sparkle framework on the Oracle Java SE software platform relates to the exposure of files or directories to external parties. Exploiting this vulnerability could allow an attacker to bypass the EdDSA signature verification and gain full control over the application...

Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak for AIOps version 4.10.1 Vulnerability Details CVEID:CVE-2025-22233 DESCRIPTION: CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names...

CVE-2025-54410

Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. A firewalld vulnerability affects Moby releases before 28.0.0. When firewalld reloads, Docker fails to re-create...

CVE-2025-54410

CVE-2025-54410 affects Moby (Docker Engine, Mirantis Container Runtime, and downstreams). A firewalld-related issue causes Docker to fail to re-create iptables rules that isolate bridge networks when firewalld reloads, allowing containers to reach ports across bridge networks on the same host. Th...