CVE-2025-7339

A header modification flaw has been discovered in the on-headers npm library. In specific cases, response headers may be inadvertently modified when an array is passed to response.writeHead. Mitigation Users may work around this issue by passing an object rather than an array to the...

CVE-2025-53927 MaxKB sandbox bypass

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.0.0, the sandbox design rules can be bypassed because MaxKB only restricts the execution permissions of files in a specific directory. Therefore, an attacker can use the shutil.copy2 method in Python to copy the command they...

CVE-2025-53964

GoldenDict 1.5.0 and 1.5.1 has an exposed dangerous method that allows reading and modifying files when a user adds a crafted dictionary and then searches for any term included in that dictionary...

The vulnerability of the Input Method Editor (IME) component in Windows operating systems, which allows attackers to exploit their privileges

The vulnerability of the Input Method Editor IME component in Windows operating systems is related to the possibility of using memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...

goldendict -- dangerous method exposed

[email protected] reports: GoldenDict 1.5.0 and 1.5.1 has an exposed dangerous method that allows reading and modifying files when a user adds a crafted dictionary and then searches for any term included in that dictionary...

CVE-2025-34128

A buffer overflow vulnerability exists in the X360 VideoPlayer ActiveX control VideoPlayer.ocx version 2.6 when handling overly long arguments to the ConvertFile method. An attacker can exploit this vulnerability by supplying crafted input to cause memory corruption and execute arbitrary code...

CVE-2025-34128

CVE-2025-34128 describes a buffer overflow in X360 VideoPlayer ActiveX control (VideoPlayer.ocx) v2.6 triggered by overly long arguments to ConvertFile(), leading to memory corruption and arbitrary code execution in the executing process. Affected component is the ActiveX control; root cause is a...

Tucows (VDP): Vulnerability: XML-RPC Interface Enabled and Accessible

Summary The website ███ has the XMLRPC interface enabled which exposes several methods including pingbackping and systemmulticall These methods can be abused by attackers to perform high volume denial of service DDoS attacks and brute force amplification attacks which can severely impact the...

NodeJS 24.x - Path Traversal

Exploit Title : NodeJS 24.x - Path Traversal Exploit Author : Abdualhadi khalifa CVE : CVE-2025-27210 import argparse import requests import urllib.parse import json import sys def exploitpathtraversalprecisetargeturl: str, targetfile: str, method: str - dict: traversesequence = "..\" 6...

OSV-2025-547 Security exception in com.alibaba.fastjson2.JSONReader.readArray

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=431584944 Crash type: Security exception Crash state: com.alibaba.fastjson2.JSONReader.readArray java.base/java.nio.charset.CharsetEncoder. java.base/java.nio.charset.CharsetEncoder...

Denial Of Service (DoS)

org.apache.commons, commons-lang3 is vulnerable to Denial Of Service DoS. The vulnerability is due to improper handling of long input strings in the ClassUtils.getClass... method, which allows an attacker to trigger a StackOverflowError...

Regular Expression Denial Of Service (ReDoS)

Transformers is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to the use of a vulnerable regex pattern in the DonutProcessor.token2json method, which allows an attacker to craft malicious input causing excessive CPU consumption through catastrophic backtrackin...

The vulnerability of the Input Method Editor (IME) component of Microsoft Windows, which allows a hacker to gain elevated privileges

The vulnerability of the Input Method Editor IME component in Microsoft Windows is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to gain increased privileges remotely...

VulnCheck KEV: CVE-2011-4085

The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods, which allow remote attackers to bypass authentication ...

The vulnerability of the Input Method Editor (IME) component of Microsoft Windows, which allows a hacker to gain elevated privileges

The vulnerability of the Input Method Editor IME component in Microsoft Windows lies in the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow attackers to gain increased privileges...

Transformers is vulnerable to ReDoS attack through its DonutProcessor class

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's token2json method. This vulnerability affects versions 4.51.3 and earlier, and is fixed in version 4.52.1. The issue arises from the...

CVE-2025-3933

CVE-2025-3933 (Hugging Face Transformers) A ReDoS vulnerability exists in the DonutProcessor.token2json() implementation where the regex pattern (and a similar pattern in later mention) can cause catastrophic backtracking and high CPU usage. Affected: Transformers versions 4.50.3 and earlier. Im...

CVE-2025-3933 Regular Expression Denial of Service (ReDoS) in huggingface/transformers

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's token2json method. This vulnerability affects versions 4.50.3 and earlier, and is fixed in version 4.52.1. The issue arises from the...

CVE-2025-3933 Regular Expression Denial of Service (ReDoS) in huggingface/transformers

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's token2json method. This vulnerability affects versions 4.50.3 and earlier, and is fixed in version 4.52.1. The issue arises from the...

When and Where Do Data Poisons Attack Textual Inversion?

Poisoning attacks pose significant challenges to the robustness of diffusion models DMs. In this paper, we systematically analyze when and where poisoning attacks textual inversion TI, a widely used personalization technique for DMs. We first introduce Semantic Sensitivity Maps, a novel method fo...