CVE-2025-53506

A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service. Mitigation Mitigation for thi...

CVE-2025-53628

A memory exhaustion flaw has been discovered in cpp-httplib. cpp-httplib does not have a limit for a unique line, which permits an attacker to explore this to allocate memory arbitrarily. Mitigation Mitigation for this issue is either not available or the currently available options do not meet t...

CVE-2025-53629

A memory exhaustion flaw has been discovered in cpp-httplib. cpp-httplib allows incoming requests using Transfer-Encoding: chunked in the header to allocate memory arbitrarily in the server, potentially leading to its exhaustion. Mitigation Mitigation for this issue is either not available or the...

CVE-2025-53630

An integer overflow flaw was found in llama.cpp. This flaw exists in the ggufinitfromfileimpl function in ggml/src/gguf.cpp and can lead to heap out-of-bounds read/write. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Produc...

CVE-2025-53549

An SQL injection flaw was found in Matrix Rust SDK. The EventCache::findeventwithrelations method of matrix-sdk allows malicious room members to execute arbitrary SQL commands in Matrix clients that directly pass relation types provided by those room members into this method when used with the...

CVE-2025-52473

An observable discrepancy was found in the reference implementation of the HQC key encapsulation mechanism when it is compiled with Clang for optimization levels above -O0 onto -O1, -O2, and beyond. A proof-of-concept local attack exploits this secret-dependent information to recover the entire...

CVE-2025-53862

A flaw was found in Ansible. Three API endpoints are accessible and return verbose, unauthenticated responses. This flaw allows a malicious user to access data that may contain important information. Mitigation Currently, there is no mitigation available for this vulnerability...

CVE-2025-53861

A flaw was found in Ansible. Sensitive cookies without security flags over non-encrypted channels can lead to Man-in-the-Middle MitM and Cross-site scripting XSS attacks allowing attackers to read transmitted data. Mitigation Currently, there is no mitigation available for this vulnerability...

CVE-2025-53020

A memory exhaustion flaw has been discovered in the Apache HTTP server. In some instances, the Apache HTTP server fails to free memory. Given sufficient time, this may lead to the host operating system killing the web server in order to reclaim memory. Mitigation Mitigation for this issue is eith...

CVE-2024-43394

A Server-Side Request Forgery SSRF flaw was found in Apache HTTP Server on Windows. This issue can allow NTLM hashes to be leaked to a malicious server via modrewrite or apache expressions that pass unvalidated request input. Mitigation Mitigation for this issue is either not available or the...

CVE-2025-6211

A vulnerability in the DocugamiReader class of the run-llama/llamaindex repository, up to version 0.12.28, involves the use of MD5 hashing to generate IDs for document chunks. This approach leads to hash collisions when structurally distinct chunks contain identical text, resulting in one chunk...

CVE-2025-7425

A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may acce...

CVE-2025-7424

A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of...

CVE-2025-6395

A NULL pointer dereference flaw was found in the GnuTLS software in gnutlsfigurecommonciphersuite. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability...

Exploit for CVE-2024-3568

Exploitation of pickle deserialization vulnerabilities in Tran...

CVE-2025-38317

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix buffer overflow in debugfs If the user tries to write more than 32 bytes then it results in memory corruption. Fortunately, this is debugfs so it's limited to root users...

Exploit for Path Traversal in Rarlab Winrar

CVE-2025-6218-WinRAR-Directory-Traversal-RCE CVE-2025-6218 is...

WordPress Pro Bulk Watermark Plugin for WordPress Theme <= 2.0 is vulnerable to Path Traversal

Software Pro Bulk Watermark Plugin for WordPress Type Theme Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Path Traversal CVE CVE-2025-28973 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID c40f943bba08 Credits Tran Nguyen Bao Khanh VCI -...

Giving AI Agents Access to Cryptocurrency and Smart Contracts Creates New Vectors of AI Harm

There is growing interest in giving AI agents access to cryptocurrencies as well as to the smart contracts that transact them. But doing so, this position paper argues, could lead to formidable new vectors of AI harm. To support this argument, we first examine the unique properties of...

docusaurus-plugin-content-gists vulnerability exposes GitHub Personal Access Token

GitHub Personal Access Token Exposure in docusaurus-plugin-content-gists Summary docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for...