PT-2025-13709

Name of the Vulnerable Software and Affected Versions acmemediakits ACME Divi Modules versions 1.3.5 and earlier Description The issue is related to a lack of authorization in acmemediakits ACME Divi Modules, which can be exploited due to incorrectly configured access control security levels...

GHSA-MMWX-RJ87-VFGR vulnerabilities

Vulnerabilities for packages: spark, hadoop-client-modules, druid...

RHEL 9 : kpatch-patch-5_14_0-427_13_1, kpatch-patch-5_14_0-427_31_1, kpatch-patch-5_14_0-427_44_1, and kpatch-patch-5_14_0-427_55_1 (RHSA-2025:3097)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3097 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module i...

RHEL 8 : kpatch-patch-4_18_0-305_120_1, kpatch-patch-4_18_0-305_138_1, kpatch-patch-4_18_0-305_145_1, and kpatch-patch-4_18_0-305_150_1 (RHSA-2025:3093)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3093 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module i...

CVE-2025-29217

Tenda W18E v2.0 v16.01.0.11 was discovered to contain a stack overflow in the wifiSSID parameter at /goform/setModules. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2025-29217

Tenda W18E v2.0 v16.01.0.11 was discovered to contain a stack overflow in the wifiSSID parameter at /goform/setModules. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

Arbitrary Command Injection

Overview lollms is a python library for AI personality definition Affected versions of this package are vulnerable to Arbitrary Command Injection in the calculate function, which uses the eval function without sufficient protection. An attacker can execute commands on the server by injecting...

Tenda W18E 安全漏洞

The Tenda W18E is a wireless router from the Chinese company Tenda. A stack overflow vulnerability exists in the Tenda W18E /goform/setModules handling of the wifiPwd parameter, which can be exploited by an attacker to submit a special request that can crash the application and cause a denial of...

Tenda W18E 安全漏洞

The Tenda W18E is a wireless router from the Chinese company Tenda. A stack overflow vulnerability exists in the Tenda W18E /goform/setModules handling of the wifiSSID parameter, which can be exploited by an attacker to submit a special request that can crash the application and cause a denial of...

Malicious code in pb-node-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13f6ed4f1be7aaf5a813cae62ab02bae6da785284b44b4ec1ef18522f3c0f7a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the system-mounted module in operating systems such as Synology BeeStation Manager (BSM), Synology DiskStation Manager (DSM), and the enterprise-level server Synology Unified Controller allows a perpetrator to execute arbitrary code.

The vulnerability of the system-mounted modules of the Synology BeeStation Manager BSM, Synology DiskStation Manager DSM, and the corporate-level server Synology Unified Controller lies in the lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows a remote...

[SECURITY] Fedora 42 Update: libxml2-2.12.10-1.fc42

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

CVE-2025-29779

The CVE describes a fault-injection countermeasure weakness in the Python implementation of Post-Quantum Secure Feldman’s Verifiable Secret Sharing (VSS) in PostQuantum-Feldman-VSS, specifically the secure_redundant_execution function. Affected versions up to 0.8.0b2 are vulnerable because Python...

Malicious code in kamino-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ecb59e56c69eee3911cd10b7de6d341cf4d2f2f41bab590b44428c5bfd8348b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2388 Malicious code in kamino-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ecb59e56c69eee3911cd10b7de6d341cf4d2f2f41bab590b44428c5bfd8348b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GO-2025-3512 kubevirt-csi: PersistentVolume allows access to HCP's root node in github.com/kubevirt/csi-driver

kubevirt-csi: PersistentVolume allows access to HCP's root node in github.com/kubevirt/csi-driver. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

CVE-2025-20143

A vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker with high privileges to bypass the Secure Boot functionality and load unverified software on an affected device. To exploit this vulnerability, the attacker must have root-system privileges o...

PT-2025-11030

Name of the Vulnerable Software and Affected Versions: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution plugin for WordPress versions up to, and including, 3.1.0 Description: The issue is related to a Stored DOM-Based Cross-Site Scripting...

CVE-2025-1527: Improper Neutralization of Input During Web Page Generation

The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution formerly WooLentor plugin for WordPress is vulnerable to a Stored DOM-Based Cross-Site Scripting via the plugin's Flash Sale Countdown module in all versions up to, and including, 3.1.0 due to...

PYSEC-2025-122

The Keras Model.loadmodel function permits arbitrary code execution, even with safemode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, ...