CVE-2025-1385

When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits...

CVE-2025-1385 Fail input validation in clickhouse-library-bridge API could lead to RCE under specific configuration

When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits...

Inure 信息泄露漏洞

Inure is an Android application manager by the individual developer Hamza Rizwan. An information disclosure vulnerability exists in versions prior to Inure build97, which stems from a misconfiguration of the AndroidManifest.xml file and could lead to task hijacking and disclosure of sensitive...

NetEase QAnything 访问控制错误漏洞

NetEase QAnything is a local knowledge base question and answer system from China's NetEase NetEase dedicated to supporting arbitrary format files or databases, which can be installed and used offline. An access control error vulnerability exists in NetEase QAnything version 1.4.1, which stems fr...

PT-2025-12222

Name of the Vulnerable Software and Affected Versions prefecthq/prefect version 2.20.2 Description A CORS Cross-Origin Resource Sharing misconfiguration allows unauthorized domains to access sensitive data, potentially leading to unauthorized access to the database. This can result in data leaks,...

feast 访问控制错误漏洞

feast is an AI/ML open source function library from Feast Open Source. An access control error vulnerability exists in feast version 0.40.0, which stems from a misconfiguration of CORS and could lead to the disclosure of sensitive information...

Danswer 访问控制错误漏洞

Danswer is Danswer AI open source an artificial intelligence assistant that connects to company documents, applications and people. An Access Control Error vulnerability exists in Danswer v1.4.1, which stems from a misconfiguration of CORS and could lead to the disclosure of sensitive information...

MLflow 安全漏洞

MLflow is an open source platform from MLflow that simplifies machine learning development, including tracking experiments, packaging code into repeatable runs, and sharing and deploying models. A security vulnerability exists in MLflow version 2.15.1, which stems from a misconfiguration of the...

PT-2025-12207 · Unknown · Netease-Youdao/Qanything

Name of the Vulnerable Software and Affected Versions: netease-youdao/qanything version 1.4.1 Description: A Cross-Origin Resource Sharing CORS misconfiguration exists that allows an attacker to bypass the Same-Origin Policy, potentially leading to sensitive information exposure. Properly...

The vulnerability of the cdns_i2c_master_xfer() function in the drivers/i2c/busses/i2c-cadence.c module of the Linux kernel allows a hacker to gain access to protected information.

The vulnerability of the cdnsi2cmasterxfer function in the drivers/i2c/busses/i2c-cadence.c module of the Linux kernel is related to security configuration errors. Exploiting this vulnerability could allow an attacker to gain access to protected information...

The vulnerability of the stm32f7_i2c_xfer() function in the Linux kernel’s drivers/i2c/busses/i2c-stm32f7.c file allows a hacker to gain access to protected information.

The vulnerability of the stm32f7i2cxfer function in the drivers/i2c/busses/i2c-stm32f7.c module of the operating system’s kernel is related to security configuration errors. Exploiting this vulnerability could allow an attacker to gain access to protected information...

Mattermost Desktop App 安全漏洞

Mattermost Desktop App is a cross-platform desktop collaboration tool based on the Electron framework, supporting Windows, macOS and Linux systems, designed for team collaboration. A privilege misconfiguration vulnerability exists in Mattermost Desktop App. The vulnerability stems from declaring...

CVE-2025-27913

Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...

HealthTech Database Exposed 108GB Medical and Employment Records

A misconfigured database exposed 108.8 GB of sensitive data, including information on over 86,000 healthcare workers affiliated with…...

GHSA-59QH-FMM7-3G9Q Rembg CORS misconfiguration

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allowcredentia...

Rembg CORS misconfiguration

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allowcredentia...

CVE-2025-28874

Authorization Bypass Through User-Controlled Key vulnerability in shanebp BP Email Assign Templates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects BP Email Assign Templates: from n/a through 1.6...

CVE-2025-27913

Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...

CVE-2025-27913

CVE-2025-27913 concerns Passbolt API prior to version 5. The description in multiple sources states that a server misconfiguration during installation (and disregard of Health Check results) allows emails to be sent with a domain name taken from an attacker-controlled HTTP Host header. The CVSS d...

CVE-2025-27913

Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...