CVE-2025-22169

Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to subscribe to an item/object without having the expected permission level...

CVE-2025-11844

Hugging Face Smolagents 1.20.0 has an XPath injection in search_item_ctrl_f (vision_web_browser.py) where user input is concatenated into XPath queries without sanitization, allowing attackers to modify query logic, bypass filters, and access unintended DOM elements, potentially disrupting AI web...

CVE-2025-11844 XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function

Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the searchitemctrlf function located in src/smolagents/visionwebbrowser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitizatio...

WordPress plugin UPC/EAN/GTIN Code Generator 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site request...

CVE-2025-53043

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite component: Item Catalog. Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful...

CVE-2025-53043

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite component: Item Catalog. Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful...

EUVD-2025-35291

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite component: Item Catalog. Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful...

CVE-2025-40007

CVE-2025-40007 — Linux kernel netfs reference leak (concrete details) The issue is in netfs: fix reference leak inside the Linux kernel’s netfs code. A commit (20d72b00ca81) changed netfs_alloc_request() to initialize the reference counter to 2 instead of 1, under the assumption that the request’...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a cyclic delayed work-item leading to reuse after release, which could lead to memory corruption...

WordPress UPC/EAN/GTIN Code Generator plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan in WordPress Plugin UPC/EAN/GTIN Code Generator versions = 2.0.2...

Malicious Package

Overview item-box is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Astra Linux - уязвимость в libheif

libheif before 1.19.6 has a NULL pointer dereference in ImageItemGrid::getdecoder in image-items/grid.cc because a grid image can reference a nonexistent image item...

CVE-2025-61858

An out-of-bounds write vulnerability exists in VS6ComFile!setAnimationItem of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end ABEND, and arbitrary code execution...

CVE-2025-61858

An out-of-bounds write vulnerability exists in VS6ComFile!setAnimationItem of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end ABEND, and arbitrary code execution...

CVE-2025-61858

An out-of-bounds write vulnerability exists in VS6ComFile!setAnimationItem of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end ABEND, and arbitrary code execution...

CVE-2025-61859

An out-of-bounds write vulnerability exists in VS6ComFile!CItemDraw::ismotiontween of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end ABEND, and arbitrary code execution...

EUVD-2025-33698

An out-of-bounds write vulnerability exists in VS6ComFile!setAnimationItem of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end ABEND, and arbitrary code execution...

CVE-2025-61858

An out-of-bounds write vulnerability exists in VS6ComFile!setAnimationItem of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end ABEND, and arbitrary code execution...

CVE-2025-61858

The CVE-2025-61858 entry concerns Fuji Electric V-SFT (VS6ComFile!set_AnimationItem) with out-of-bounds write affecting V-SFT v6.2.7.0 and earlier. Documented impacts include information disclosure, abnormal termination (ABEND), and arbitrary code execution. Affected component is the VS6ComFile s...

PT-2025-41549

Name of the Vulnerable Software and Affected Versions V-SFT versions 6.2.7.0 and earlier Description An out-of-bounds write vulnerability exists in the VS6ComFile!set AnimationItem function. Opening specially crafted V-SFT files may lead to information disclosure, application crashes ABEND, and...