CVE-2025-1386 Query smuggling in ch-go library

When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker in control of such data to smuggle another query packet into the connection stream...

CVE-2025-3288

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute...

CVE-2025-2285

A local code execution vulnerability exists in the Rockwell Automation Arena® due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the...

CVE-2025-2288

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute...

Cisco TelePresence Management Suite XSS (cisco-sa-tms-xss-vuln-WbTcYwxG)

According to its self-reported version, Cisco TelePresence Management Suite is affected by a cross-site scripting vulnerability. - A vulnerability in the web-based management interface of Cisco TelePresence Management Suite TMS could allow a low-privileged, remote attacker to conduct a cross-site...

CVE-2025-30211

A flaw was found in Erlang/OTP. This vulnerability allows an attacker to cause high memory consumption via a maliciously crafted KEX init message that exceeds RFC-specified limits on algorithm names...

CVE-2024-12858

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate of CVE-2025-22880...

CVE-2025-20208

A vulnerability in the web-based management interface of Cisco TelePresence Management Suite TMS could allow a low-privileged, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient input validation by the web-based...

Deserialization Of Untrusted Data

vLLM is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to unsafe deserialization due to the torch.load function loading malicious pickle data with weightsonly set to False, allowing arbitrary code execution during unpickling...

PYSEC-2025-58

vLLM is a library for LLM inference and serving. vllm/modelexecutor/weightutils.py implements hfmodelweightsiterator to load the model checkpoint, which is downloaded from huggingface. It uses the torch.load function and the weightsonly parameter defaults to False. When torch.load loads malicious...

Cisco Crosswork Network Controller Stored Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Crosswork Network Controller could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against users of the interface of an affected system. These vulnerabilities exist because the web-based...

Apache Arrow R package: Arbitrary code execution when loading a malicious data file

...

CVE-2021-1466

A vulnerability in the vDaemon service of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to cause a buffer overflow on an affected system, resulting in a denial of service DoS condition. The vulnerability is due to incomplete bounds checks for data that is provided to...

CVE-2024-47486

There is an XSS vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could inject scripts into certain pages by building malicious data...

CVE-2024-47486

There is an XSS vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could inject scripts into certain pages by building malicious data...

CVE-2024-47486

There is an XSS vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could inject scripts into certain pages by building malicious data...

CVE-2024-47486

CVE-2024-47486 affects Hikvision HikCentral Master Lite with an XSS vulnerability that enables an attacker to inject scripts into certain pages by submitting malicious data. The initial description notes XSS in some HikCentral Master Lite versions; connected sources corroborate the issue but do n...

PT-2024-33485 · Acon · Acon

Name of the Vulnerable Software and Affected Versions: ACON affected versions not specified Description: A potential issue has been identified in the input validation process of the ACON library, which could lead to arbitrary code execution if exploited. This could allow an attacker to submit...

Hikvision HikCentral Master Lite 安全漏洞

Hikvision HikCentral Master Lite is an AI Cloud-based application management intelligence platform for edge domains from Hikvision, China. A security vulnerability exists in Hikvision HikCentral Master Lite, which stems from a cross-site scripting XSS vulnerability that allows an attacker to inje...

Deserialization

org.apache.lucene,lucene-replicator is vulnerable to Deserialization. The vulnerability is due to improper validation of serialized input in the org.apache.lucene.replicator.http package, allows attackers to exploit the deserialization process by sending malicious data...