CVE-2025-29630

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue; there is no indication that an applicable SSH private key has ever been compromised. Notes: none...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from not disabling interrupts before resetting the GPU...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via the calculation of the session ID during the key exchange process. An attacker can cause a crash of SSH clients or servers by triggering an allocation failure in cryptographic functions. Remediation Upgrade...

Malicious code in bingo-abstract-transport (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c453cfd4d38bc70b9b47a64bb81b2c3c982b8811f3fefe95b1788b5a24340808 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kiwi-module-cdp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 34281bc0357b483d9a5d7b84475fd6e4c2db6e993a61ff41636ee26e388368d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

(Pwn2Own) Phoenix Contact CHARX SEC-3150 Origin Validation Error Firewall Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass firewall rules and access another interface on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of firewa...

Liner Insecure Direct Object Reference / Brute Force

Liner is a reliable AI search engine with over 10 million users worldwide. It is vulnerable to an insecure direct object reference vulnerability. Conversation histories for all users are stored on the server. However, Liner's server does not distinguish the ownership or sharing status of individu...

CVE-2025-7910

A vulnerability classified as critical has been found in D-Link DIR-513 1.10. This affects the function sprintf of the file /goform/formSetWanNonLogin of the component Boa Webserver. The manipulation of the argument curTime leads to stack-based buffer overflow. It is possible to initiate the atta...

CVE-2025-7880

A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2 and classified as critical. Affected by this issue is some unknown functionality of the file /business/common/sms/sendsms.jsp. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. Th...

PT-2025-30137 · Jinher Oa · Jinher Oa

Name of the Vulnerable Software and Affected Versions: Jinher OA version 1.2 Description: A vulnerability exists in Jinher OA 1.2 related to xml external entity reference within the ProjectScheduleDelete.aspx file. This issue can be exploited remotely. The exploit has been publicly disclosed...

User Enumeration via "Account not found" Message

This report is not public...

CVE-2025-22227

A flaw was found in io.projectreactor.netty/reactor-netty. Reactor Netty’s HTTP client, when explicitly configured to follow redirects in chained redirect scenarios, can inadvertently leak credentials. This flaw allows an attacker to trigger this credential leakage by manipulating the redirect...

Cisco Identity Services Engine enableStrongSwanTunnel Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Identity Services Engine. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the enableStrongSwanTunnel method. The issue result...

K000152592: Apache Tomcat vulnerability CVE-2025-46701

Security Advisory Description Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1...

WordPress plugin Hestia 安全漏洞

WordPress Hestia is a free corporate theme for the WordPress platform, developed by ThemeIsle. The theme is known for its clean and generous design, responsive layout and rich functionality, supporting drag-and-drop page editing, SEO optimization and other features, which is suitable for quickly...

CVE-2025-50095

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks ...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the DDL component. An attacker can cause the server to hang or crash repeatedly by sending crafted requests over the network with high privileges. Details Denial of Service DoS describes a family of attacks, al...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the DML component. An attacker can cause the server to hang or crash repeatedly by sending crafted requests over the network. Details Denial of Service DoS describes a family of attacks, all aimed at making a...

Use After Free

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Use After Free via improper handling of possible socket destruction in P2PSocketTcpBase. An attacker can...

Malicious code in asios.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9de41cd145f6fc73566a02847dc79c1f7237e2aa159ac104f24fed3b920ea24b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...