The vulnerability in the driver/s390/crypto/pkey_api.c component of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability in the drivers/s390/crypto/pkeyapi.c component of the Linux operating system’s kernel is related to incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

django: Potential denial-of-service in django.utils.html.strip_tags()

A vulnerability was found in the Django Web Framework. The striptags and stripbtags template filter may be vulnerable to a potential denial of service DoS in cases of a large sequence of nested incomplete HTML entities...

Malicious code in theice (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a5284ff23f0c6a6b960f00ae8adcf8fd068d714b2689229fa6355a69fc5d778 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-22865 ParsePKCS1PrivateKey panic with partial keys in crypto/x509

Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed...

CVE-2025-22865 ParsePKCS1PrivateKey panic with partial keys in crypto/x509

Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed...

CVE-2025-0473 Incomplete Cleanup vulnerability in PMB platform

Vulnerability in the PMB platform that allows an attacker to persist temporary files on the server, affecting versions 4.0.10 and above. This vulnerability exists in the file upload functionality on the ‘/pmb/authorities/import/iimportauthorities’ endpoint. When a file is uploaded via this...

django: Potential denial-of-service in django.utils.html.strip_tags()

A vulnerability was found in the Django Web Framework. The striptags and stripbtags template filter may be vulnerable to a potential denial of service DoS in cases of a large sequence of nested incomplete HTML entities...

GHSA-VG7J-7CWX-8WGW Mongoose search injection vulnerability

Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access...

CVE-2025-23061

CVE-2025-23061 affects Mongoose before 8.9.5, enabling search injection via a nested $where filter in populate() match. This builds on an incomplete fix for CVE-2024-53900, as evidenced by multiple connected documents (Nuclei template, IBM security bulletins, and IBM/CVE details) describing NoSQL...

CVE-2025-23061

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900...

EUVD-2025-0106

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900...

CVE-2024-13162

SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. This CVE addresses incomplete fixes from CVE-2024-32848...

CVE-2024-13162

SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. This CVE addresses incomplete fixes from CVE-2024-32848...

CVE-2024-13162

SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. This CVE addresses incomplete fixes from CVE-2024-32848...

CVE-2024-13180

Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to leak sensitive information. This CVE addresses incomplete fixes from CVE-2024-47011...

CVE-2024-13181

Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. This CVE addresses incomplete fixes from CVE-2024-47010...

CVE-2024-13181

Ivanti Avalanche is affected by CVE-2024-13181 (Path Traversal) in versions prior to 6.4.7. Root cause: incomplete fixes from CVE-2024-47010 allow a remote, unauthenticated attacker to bypass authentication. Impact: high severity cast (CVE/ATT&CK not explicitly listed in docs; remediation points ...

CVE-2024-13180

Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to leak sensitive information. This CVE addresses incomplete fixes from CVE-2024-47011...

Remote Code Execution (RCE)

Overview org.webjars.npm:jsonpath-plus is an A JS implementation of JSONPath with some additional operators Affected versions of this package are vulnerable to Remote Code Execution RCE due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the...

PT-2025-37864

Name of the Vulnerable Software and Affected Versions ip aka node-ip package versions through 2.0.1 Description The ip aka node-ip package may allow Server-Side Request Forgery SSRF due to the improper categorization of the IP address value 0 as globally routable via the isPublic function. This...