22446 matches found
Unauthorized Disclosure Of Sensitive Data
github.com/rancher/fleet is vulnerable to Unauthorized Disclosure of Sensitive Data. The vulnerability is due to improper access control on BundleDeployment resources with GET or LIST permissions, which allows an attacker to retrieve Helm values containing credentials or other secrets...
Glib-networking: out of bound reads on glib-networking through tls/openssl/gtlscertificate-openssl.c via "g_tls_certificate_openssl_get_property()"
...
CVE-2025-11146: Improper Neutralization of Input During Web Page Generation
Reflected Cross-site scripting XSS in Apt-Cacher-NG v3.2.1. The vulnerability allows an attacker to execute malicious scripts XSS in the web management application. The vulnerability is caused by improper handling of GET inputs included in the URL in “/acng-report.html”...
CVE-2025-41244
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate...
Vasion Print Virtual Appliance Host security vulnerability
Vasion Print Virtual Appliance Host is a print management software from Vasion USA. A security vulnerability exists in Vasion Print Virtual Appliance Host versions prior to 25.1.102 that stems from the filegetcontents function not validating input, which could lead to credential disclosure and...
PT-2025-39820
Name of the Vulnerable Software and Affected Versions Apt-Cacher-NG version 3.2.1 Description A reflected cross-site scripting XSS issue exists in the web management application. This allows an attacker to execute malicious scripts. The issue is due to improper handling of GET inputs included in...
OSV-2025-788 Heap-buffer-overflow in int arrow::bit_util::BitReader::GetBatch<int>
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=447480433 Crash type: Heap-buffer-overflow READ 8 Crash state: int arrow::bitutil::BitReader::GetBatch auto arrow::util::RleBitPackedDecoder::GetBatch std::1::pair arrow::util::R...
Linux kernel Heap Buffer Overflow DoS
The vulnerability of the getmodeaccess function in the landlock/fs.c component of the Linux kernel is related to insufficient input validation. Exploiting this vulnerability could allow an attacker to trigger a service failure using a modified file...
Linux kernel Heap Buffer Overflow DoS
The vulnerability of the mm/gup component in the Linux operating system’s kernel is related to the use of memory after it has been freed. Exploiting this vulnerability can allow an attacker to cause a service failure...
CVE-2025-7647
CVE-2025-7647 affects llama-index-core up to version 0.12.44, with a vulnerability in get_cache_dir() that uses a predictable, hardcoded directory path (/tmp/llama_index) on Linux. On multi-user Linux systems, this insecure temporary directory can enable local attackers to steal proprietary model...
CVE-2025-10036
The Featured Image from URL FIFU plugin for WordPress is vulnerable to SQL Injection via the getallurls function in all versions up to, and including, 5.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
CVE-2025-59936 get-jwks poisoned JWKS cache allows post-fetch issuer validation bypass
get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. When the iss issuer claim is validated only after keys are retrieved from the cache, it is possible for cached keys from an...
@erpsquad/common (>=1.0.0, <=1.10.3-spar), @faable/auth-helpers-fastify (>=1.0.2, <=1.0.18) +22 more potentially affected by CVE-2025-59936 via get-jwks (>=4.3.0, <=10.0.0)
get-jwks NPM version =4.3.0, =1.0.0, =1.0.2, =0.4.4, =1.0.0, =1.0.0, =1.0.1, =3.1.0, =2.0.0, =0.1.0, =0.29.0, =0.0.23, =0.0.23, =0.2.0, =0.33.0, =0.1.0, =0.2.0 and more Source cves: CVE-2025-59936 Source advisory: MEND:CVE-2025-59936...
CVE-2025-59936 get-jwks poisoned JWKS cache allows post-fetch issuer validation bypass
get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. When the iss issuer claim is validated only after keys are retrieved from the cache, it is possible for cached keys from an...
CVE-2025-59936
The CVE-2025-59936 issue affects get-jwks prior to 11.0.2, where a design flaw allows cache poisoning of the JWKS cache to bypass issuer validation. If iss is validated after keys are retrieved from the cache, an attacker can craft JWTs to place a chosen public key in the shared cache and then re...
CVE-2025-59936
get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. When the iss issuer claim is validated only after keys are retrieved from the cache, it is possible for cached keys from an...
CVE-2025-59936: Improper Encoding or Escaping of Output
get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. When the iss issuer claim is validated only after keys are retrieved from the cache, it is possible for cached keys from an...
get-jwks security vulnerability
get-jwks is a Nearform open source utility for obtaining JWKS keys. A security vulnerability exists in get-jwks versions prior to 11.0.2, which stems from a cache poisoning issue in the JWKS key fetching mechanism that could lead to bypassing issuer authentication...
Improper Encoding or Escaping of Output
Overview get-jwks is a Fetch utils for JWKS keys Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the getPublicKey process. An attacker can bypass issuer validation and gain unauthorized access by poisoning the JWKS cache with a crafted public key an...
