Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the errorMsg parameter in the /xxl-sso-server/login process. An attacker can inject and execute arbitrary scripts in the context of a user's browser by crafting a malicious request. Details Cross-site...

WhatsApp Adds AI-Powered Message Summaries for Faster Chat Previews

Popular messaging platform WhatsApp has added a new artificial intelligence AI-powered feature that leverages its in-house solution Meta AI to summarize unread messages in chats. The feature, called Message Summaries, is currently rolling out in the English language to users in the United States,...

xxl-sso 安全漏洞

xxl-sso is a distributed single sign-on framework by the individual developer Xu Xueli. A security vulnerability exists in xxl-sso version 1.1.0, which is caused by incorrect operation of the errorMsg parameter in the file /xxl-sso-server/login, resulting in a cross-site scripting attack...

📄 PX4 Military UAV Autopilot 1.12.3 Denial of Service

A stack-based buffer overflow vulnerability in PX4 Military UAV Autopilot versions 1.12.3 and below is triggered when handling a malformed MAVLink message of type TRAJECTORYREPRESENTATIONWAYPOINTS. An attacker with access to the MAVLink communication channel can send a crafted packet to crash the...

PT-2025-27013 · Unknown · Infinispan Cli

Name of the Vulnerable Software and Affected Versions: Infinispan CLI affected versions not specified Description: A flaw was found in Infinispan CLI where a sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext. This password is included in a command stri...

CVE-2025-5827

Autel MaxiCharger AC Wallbox Commercial bleprocessesp32msg Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authenticati...

CVE-2025-5829

Autel MaxiCharger AC Wallbox Commercial autocharge Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers...

CVE-2025-5829

Autel MaxiCharger AC Wallbox Commercial is affected by CVE-2025-5829. The issue is a stack-based buffer overflow in JSON message handling caused by insufficient validation of user-supplied data before copying to a fixed-length buffer, enabling remote code execution. Impact: requires physical acce...

CVE-2025-5829 Autel MaxiCharger AC Wallbox Commercial autocharge Stack-based Buffer Overflow Remote Code Execution Vulnerability

Autel MaxiCharger AC Wallbox Commercial autocharge Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers...

[SECURITY] Fedora 42 Update: gotify-desktop-1.3.7-5.fc42

Small Gotify daemon to receive messages and forward them as desktop notificat ions. Read Gotify messages, and forward them as standard desktop notification . Forward message priority. Auto reconnect if server connection is lost and g et missed messages. Automatically download, cache, and show app...

CVE-2025-48700

An issue was discovered in Zimbra Collaboration ZCS 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting XSS vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information...

kernel: Kernel: Denial of Service via memory leak in SMB client

A flaw was found in the Linux kernel's Server Message Block SMB client. A local attacker with low privileges could exploit a memory leak in the cifssmb3domount function. This could lead to a Denial of Service DoS due to resource exhaustion...

wildfly-elytron: possible timing attacks via use of unsafe comparator

A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use java.security.MessageDigest.isEqual instead. This flaw allows an attacker to access secure information or...

kernel: Kernel: Denial of Service via memory leak in SMB client

A flaw was found in the Linux kernel's Server Message Block SMB client. A local attacker with low privileges could exploit a memory leak in the cifssmb3domount function. This could lead to a Denial of Service DoS due to resource exhaustion...

RHEL 10 : krb5 (RHSA-2025:9418)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9418 advisory. Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending password...

RHEL 9 : krb5 (RHSA-2025:9430)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9430 advisory. Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords...

PT-2025-28872

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.16.0-rc3-build2+ 1301 Description: The Linux kernel contains a flaw within the SMB client implementation that can lead to a potential deadlock when reconnecting channels. Specifically, an incorrect lock order...

CVE-2025-52883

Meshtastic-Android is an Android application for the mesh radio software Meshtastic. Prior to version 2.5.21, an attacker is able to send an unencrypted direct message to a victim impersonating any other node of the mesh. This message will be displayed in the same chat that the victim normally...

CVE-2025-6579

A vulnerability was found in code-projects Car Rental System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /messageadmin.php. The manipulation of the argument Message leads to sql injection. The attack may be initiated remotely. The exploit has been...

CVE-2025-52883

Meshtastic-Android prior to version 2.5.21 is vulnerable: an attacker can send an unencrypted direct message impersonating another node, which is displayed in the victim’s chat as PKC-secured due to a forged green padlock. The victim may trust and read the attacker’s message as legitimate. Versio...