Improper Validation of Specified Type of Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input due to the improper validation of plugin bot identity. An attacker can cause users to add reactions to arbitrary GitHub objects by sending crafted notification posts. Remediation Upgrade...

CVE-2025-61736

CVE-2025-61736 affects Johnson Controls iSTAR series (e.g., iSTAR eX, iSTAR Edge, iSTAR Ultra LT/Ultra/SE). The issue is an improper handling of certificate expiration that can cause the device to fail to re-establish communication after a certificate expires. This vulnerability is named in CVE r...

CVE-2025-61736 iSTAR- Improper Validation of Certificate Expiration

Successful exploitation of this vulnerability could result in the product failing to re-establish communication once the certificate expires...

Improper Validation of Syntactic Correctness of Input

Overview Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input via the webhook endpoint. An attacker can enumerate components and trigger updates for multiple repositories by sending crafted webhook payloads. Workaround This vulnerability can be...

EUVD-2025-203443

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to accept an invitation opened by a different user. Version 5.15. contains a patch. As a workaround, avoid leaving one's Weblate sessions with an invitation opened unattended...

CVE-2025-64725 Weblate has improper validation upon invitation acceptance

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to accept an invitation opened by a different user. Version 5.15. contains a patch. As a workaround, avoid leaving one's Weblate sessions with an invitation opened unattended...

CVE-2025-64725

CVE-2025-64725 affects Weblate (web-based localization tool). Multiple sources confirm a flaw in the invitation-acceptance flow: an invitation opened by one user could be accepted by another due to improper validation prior to version 5.15. The vulnerability enables unauthorized access to invitat...

CVE-2025-64725 Weblate has improper validation upon invitation acceptance

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to accept an invitation opened by a different user. Version 5.15. contains a patch. As a workaround, avoid leaving one's Weblate sessions with an invitation opened unattended...

Directory Traversal

NiceGUI is vulnerable to Directory Traversal. The vulnerability is due to improper validation in the App.addmediafiles function, which allows an attacker to access and read arbitrary files from the server filesystem...

Remote Code Execution (RCE)

net.mingsoft, ms-mcms is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper validation in the Template Management function, which allows an attacker to execute arbitrary code via a crafted payload...

CVE-2024-2105

An unauthorised attacker within bluetooth range may use an improper validation during the BLE connection request to deadlock the affected devices...

CVE-2025-67716 Auth0 Next.js SDK has Improper Validation of Query Parameters

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request...

Google Pixel 安全漏洞

Google Pixel is a smartphone from Google, an American company. Google Pixel has a security vulnerability that stems from improper validation of the aocservicereadmessage input in aocipccore.c, which could lead to local elevation of privilege...

PT-2025-50324

An unauthorised attacker within bluetooth range may use an improper validation during the BLE connection request to deadlock the affected devices...

Improper validation of <img> tag size in Text component parser

...

WordPress plugin Takeads 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

PT-2025-48251

Name of the Vulnerable Software and Affected Versions Blubrry PowerPress plugin for WordPress versions through 11.15.2 Description The Blubrry PowerPress plugin for WordPress is susceptible to arbitrary file uploads because of inadequate file type validation. The powerpress edit post function doe...

Improper Validation of Specified Type of Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the NudmSubscriberDataManagement API. An attacker can disrupt service availability by sending crafted requests to this API endpoint. Remediation Upgrade...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index via the tlsverifycallback function. An attacker can cause the application to crash by sending a specially crafted DTLS handshake that results in SSLgetexdataX509STORECTXidx returning -1. Remediation...

PT-2025-47260

Name of the Vulnerable Software and Affected Versions WP Dropzone versions prior to 1.1.1 Description The WP Dropzone plugin for WordPress is susceptible to unauthorized file uploads. Authenticated attackers with subscriber-level access or higher can upload arbitrary files to the server through t...