CVE-2025-11864

CVE-2025-11864 affects NucleoidAI Nucleoid up to 0.7.10. The vulnerable element is the function extension.apply in /src/cluster.ts of the Outbound Request Handler. Manipulation of the argument https/ip/port/path/headers can lead to server-side request forgery (SSRF). The attack can be performed r...

CVE-2025-11864 NucleoidAI Nucleoid Outbound Request cluster.ts extension.apply server-side request forgery

A vulnerability was identified in NucleoidAI Nucleoid up to 0.7.10. The impacted element is the function extension.apply of the file /src/cluster.ts of the component Outbound Request Handler. Such manipulation of the argument https/ip/port/path/headers leads to server-side request forgery. The...

Smidge is vulnerable to Path Traversal

A security vulnerability has been detected in Shazwazza Smidge up to 4.5.1. The impacted element is an unknown function of the component Bundle Handler. The manipulation of the argument Version leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 4.6.0 is...

GHSA-9RVM-P3QM-F4VV Smidge is vulnerable to Path Traversal

A security vulnerability has been detected in Shazwazza Smidge up to 4.5.1. The impacted element is an unknown function of the component Bundle Handler. The manipulation of the argument Version leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 4.6.0 is...

CVE-2025-11842

A security vulnerability has been detected in Shazwazza Smidge up to 4.5.1. The impacted element is an unknown function of the component Bundle Handler. The manipulation of the argument Version leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 4.6.0 is...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the Bundle Handler component when processing the Version argument. An attacker can access or modify files outside the intended directory by supplying crafted input remotely. Details A Directory Traversal attack...

CVE-2025-11842

The CVE-2025-11842 entry concerns Smidge (up to 4.5.1) with a path traversal vulnerability in the Bundle Handler that abuses the Version argument. This enables remote access to files outside the intended directory. A fix is available: upgrade Smidge Core to version 4.6.0 or higher. Connected sour...

CVE-2025-11842 Shazwazza Smidge Bundle path traversal

A security vulnerability has been detected in Shazwazza Smidge up to 4.5.1. The impacted element is an unknown function of the component Bundle Handler. The manipulation of the argument Version leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 4.6.0 is...

CVE-2025-11842 Shazwazza Smidge Bundle path traversal

A security vulnerability has been detected in Shazwazza Smidge up to 4.5.1. The impacted element is an unknown function of the component Bundle Handler. The manipulation of the argument Version leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 4.6.0 is...

CVE-2025-11842 Shazwazza Smidge Bundle path traversal

A security vulnerability has been detected in Shazwazza Smidge up to 4.5.1. The impacted element is an unknown function of the component Bundle Handler. The manipulation of the argument Version leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 4.6.0 is...

Nucleoid 代码问题漏洞

Nucleoid is a neural symbolic AI with a knowledge graph open-sourced by Nucleoid. A code issue vulnerability exists in Nucleoid 0.7.10 and earlier versions, which stems from incorrect manipulation of the parameter https/ip/port/path/headers of the function extension.apply of the component Outboun...

Smidge 路径遍历漏洞

Smidge is a file compression, composition, compression, and management library from the individual developer Shannon Deminick. A path traversal vulnerability exists in Smidge 4.5.1 and earlier versions, which stems from the incorrect manipulation of the parameter Version in the Bundle Handler...

SUSE-SU-2025:20851-1 Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2023-53261: coresight: Fix memory leak in acpibuffer-pointer bsc1249770. - CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabl...

CVE-2025-41707

The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality...

CVE-2025-10303

CVE-2025-10303 affects the WordPress Library Management System plugin. The root cause is a missing capability check in owt7_library_management_ajax_handler(), affecting all versions up to 3.1, enabling authenticated users with Subscriber-level access and above to modify various plugin settings. W...

WordPress plugin Library Management System 安全漏洞

The WordPress Library Management System plugin is a plugin for extending the functionality of WordPress, mainly used to help users manage website content, user data and system settings more efficiently. The WordPress Library Management System plugin suffers from an unauthorized data modification...

commandKit 安全漏洞

commandKit is an Under Ctrl open source development tool for building Discord bots. A security vulnerability exists in commandKit versions 1.2.0-rc.1 through 1.2.0-rc.11, which stems from a logic flaw in the message command handler that could lead to unauthorized command execution or inaccurate...

Advisory ROSA-SA-2025-3033

software: tomcat 9.0.37 WASP: ROSA-CHROME unaffected versions = tomcat-9.0.37-14 affected versions tomcat-9.0.37-14 CVE-ID: CVE-2025-48989 BDU-ID: 2025-09899 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the HTTP2 handler of the Apache Tomcat application server is related to incorrect resource...

CVE-2025-41707 Phoenix Contact: WebSocket Handler Denial of Service

The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality...

CVE-2025-41707 Phoenix Contact: WebSocket Handler Denial of Service

The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality...