PT-2025-40341

Name of the Vulnerable Software and Affected Versions OpenSIAC affected versions not specified Description An incorrect authentication issue exists in OpenSIAC that could allow an attacker to impersonate a person using Cl@ve as an authentication method. The issue enables full Cl@ve identity...

PYSEC-2025-106

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate, QuerySet.alias, QuerySet.aggregate, and QuerySet.extra are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the kwarg...

CVE-2025-54476

Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class...

CVE-2025-54476

Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class...

cups: Authentication Bypass in CUPS Authorization Handling

A flaw was found in CUPS, a widely used printing service on Linux and UNIX-like systems. The issue arises when authentication is configured to use a method other than Basic, but the attacker sends an HTTP request with a Basic authentication header. Due to improper validation in the cupsdAuthorize...

Joomla! CMS security vulnerabilities

Joomla! CMS is an open source content management system for Joomla! A security vulnerability exists in the Joomla! CMS input filtering framework, which stems from improper handling of inputs to the checkAttribute method and could lead to a cross-site scripting attack...

PT-2025-40003

Name of the Vulnerable Software and Affected Versions Versions prior to 2025-54476 Description Improper handling of input can result in a cross-site scripting XSS vector within the checkAttribute method of the input filter framework class. Recommendations At the moment, there is no information...

FreeBSD : goldendict -- dangerous method exposed (4ccd6222-9c83-11f0-a337-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4ccd6222-9c83-11f0-a337-b42e991fc52e advisory. [email protected] reports: GoldenDict 1.5.0 and 1.5.1 has an exposed dangerous method that allows reading a...

CVE-2025-59939

WeGIA (Web manager for charitable institutions) prior to version 3.5.0 is vulnerable to SQL Injection in the control.php endpoint via id_produto, where malicious command input through the id_produto parameter can exploit the site. The root cause is lack of proper sanitization and validation; the ...

CVE-2025-11014

CVE-2025-11014 affects OGRECave OGRE up to 14.4.1, specifically the function STBIImageCodec::encode in OgreSTBICodec.cpp under the Image Handler. The issue is a heap-based buffer overflow, exploitable via local access, with an exploit publicly released. Several connected sources (Snyk entries and...

OESA-2025-2354 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted...

CVE-2025-57329

web3-core-method is a package designed to creates the methods on the web3 modules. A Prototype Pollution vulnerability in the attachToObject function of web3-core-method version 1.10.4 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing...

MAL-2025-47661 Malicious code in example-custom-cart-method (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-60139: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Joovii Sendle Shipping official-sendle-shipping-method allows Cross Site Request Forgery.This issue affects Sendle Shipping: from n/a through = 6.02...

Security update for the Linux Kernel (Live Patch 49 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-15030059179 fixes several issues. The following security issues were fixed: CVE-2024-49860: ACPI: sysfs: validate return type of STR method bsc1231862. CVE-2025-38177: schhfsc: make hfscqlennotify idempotent bsc1246356. CVE-2025-38181: calipso: Fix...

CVE-2025-56769

The chinabugotech hutool library (specifically cn.hutool and hutool-extra) is vulnerable to Remote Code Execution (RCE) due to improper expression handling in the QLExpressEngine class. Attackers can submit crafted expressions to trigger arbitrary method invocations. A Proof of Concept (PoC) demo...

PT-2025-39389

Name of the Vulnerable Software and Affected Versions cors-anywhere affected versions not specified Description Instances of cors-anywhere configured as an open proxy permit unauthenticated external users to initiate HTTP requests to arbitrary targets, leading to Server-Side Request Forgery SSRF...

003-gas-convert (1.0.1), 0x-hunter-core (>=1.0.0-3, <=1.0.1-5) +6201 more potentially affected by CVE-2025-57329 via web3-core-method (>=1.0.0-beta.52, <=3.0.0-rc.5)

web3-core-method NPM version =1.0.0-beta.52, =1.0.0-3, =0.0.3, =0.0.3, =0.0.31, =1.1.0, =0.9.9, =0.1.0, =0.1.1 - 55tools-block 1.0.0 - 55tools-block-ext 1.0.0 - 84447xe5t8 1.0.0 and more Source cves: CVE-2025-57329 Source advisory: SNYK:JS-WEB3COREMETHOD-13110028...

GHSA-2J4C-9QQQ-896R web3-core-method is vulnerable to prototype pollution

web3-core-method is a package designed to creates the methods on the web3 modules. A Prototype Pollution vulnerability in the attachToObject function of web3-core-method version 1.10.4 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing...

web3-core-method is vulnerable to prototype pollution

web3-core-method is a package designed to creates the methods on the web3 modules. A Prototype Pollution vulnerability in the attachToObject function of web3-core-method version 1.10.4 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing...