GHSA-RCV9-QM8P-9P6J vulnerabilities

Vulnerabilities for packages: text-generation-inference...

CVE-2025-6051 vulnerabilities

Vulnerabilities for packages: text-generation-inference...

CVE-2025-6638 vulnerabilities

Vulnerabilities for packages: text-generation-inference...

CVE-2025-6921 vulnerabilities

Vulnerabilities for packages: text-generation-inference...

GHSA-37MW-44QP-F5JM vulnerabilities

Vulnerabilities for packages: text-generation-inference...

Reduced Password Entropy

typo3/cms-core is vulnerable to reduced password entropy. The vulnerability is due to a deterministic three-character prefix in the Password Generation component, which reduces randomness and allows an attacker to perform brute-force attacks more efficiently...

CVE-2025-62412: Improper Neutralization of Input During Web Page Generation

LibreNMS is a community-based GPL-licensed network monitoring system. The alert rule name in the Alerts Alert Rules page is not properly sanitized, and can be used to inject HTML code. This vulnerability is fixed in 25.10.0...

The vulnerability of the UserGate Next-Generation Firewall (NGFW) stems from the lack of protection for the website structure. This allows attackers to carry out XSS attacks.

The vulnerability of UserGate Next-Generation Firewall NGFW is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

EUVD-2025-34678

happy-dom's --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript...

Cross-site Scripting (XSS)

Overview mailgen is a Generates clean, responsive HTML e-mails for sending transactional mail. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the generatePlaintext function. An attacker can execute arbitrary JavaScript code in the context of the victim's browser ...

CVE-2025-62410 --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom

In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads ...

CVE-2025-62380

mailgen is a Node.js package that generates responsive HTML e-mails for sending transactional mail. Mailgen versions through 2.0.31 contain an HTML injection vulnerability in plaintext emails generated with the generatePlaintext method when user generated content is supplied. The plaintext...

CVE-2025-8429

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Centreon Infra Monitoring ACL Action access configuration modules allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from...

CVE-2025-54889

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Centreon Infra Monitoring SNMP traps manufacturer configuration modules allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13...

GRIDAI: Generating and Repairing Intrusion Detection Rules Via Collaboration among Multiple LLM-Based Agents

Rule-based network intrusion detection systems play a crucial role in the real-time detection of Web attacks. However, most existing works primarily focus on automatically generating detection rules for new attacks, often overlooking the relationships between new attacks and existing rules, which...

RoBCtrl: Attacking GNN-Based Social Bot Detectors Via Reinforced Manipulation of Bots Control Interaction

Social networks have become a crucial source of real-time information for individuals. The influence of social bots within these platforms has garnered considerable attention from researchers, leading to the development of numerous detection technologies. However, the vulnerability and robustness...

CVE-2025-62364

text-generation-webui is an open-source web interface for running Large Language Models. In versions through 3.13, a Local File Inclusion vulnerability exists in the character picture upload feature. An attacker can upload a text file containing a symbolic link to an arbitrary file path. When the...

EUVD-2025-34262

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Centreon Infra Monitoring Monitoring recurrent downtime scheduler modules allows Stored XSS.This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18,...

EUVD-2025-34442

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Centreon Infra Monitoring Commands Connectors configuration modules allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, fr...

EUVD-2025-34227

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Centreon Infra Monitoring Hosts templates configuration modules allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from...