CVE-2025-70094

CVE-2025-70094 describes an XSS flaw in the OpenSourcePOS 3.4.1 Generate Item Barcode function. The vulnerability allows an attacker to inject crafted payloads into the Item Category parameter, enabling execution of arbitrary web scripts/HTML in the victim’s browser. The issue affects the Generat...

PT-2026-8003

A cross-site scripting XSS vulnerability in the item management and sales invoice function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload...

CVE-2025-70095

OpenSourcePOS v3.4.1 is affected by a cross-site scripting (XSS) vulnerability in the item management and sales invoice function. Multiple feeds corroborate that an attacker can inject a crafted payload to execute arbitrary web scripts or HTML. Some sources flag insufficient input validation as t...

Caido 安全漏洞

Caido is an open-source application developed by Caido. It aims to help security professionals and enthusiasts efficiently and easily audit web applications. Versions of Caido prior to 0.55.0 contained a security vulnerability that allowed bypassing connection restrictions for domains not on the...

CVE-2025-70094

A cross-site scripting XSS vulnerability in the Generate Item Barcode function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Item Category parameter...

CVE-2025-70091

A cross-site scripting XSS vulnerability in the Customers function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Phone Number parameter...

CVE-2025-70095

A cross-site scripting XSS vulnerability in the item management and sales invoice function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload...

TON 安全漏洞

TON is a blockchain software developed under open source. Versions of TON prior to v2025.04 contained security vulnerabilities. These vulnerabilities stemmed from state pollution in the RUNVM instruction logic, which could lead to corruption of the parent virtual machine’s state...

CVE-2025-70092

A cross-site scripting XSS vulnerability in the Item Kits function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Item Name parameter...

MAL-2026-873 Malicious code in @depro0x/despicable-me (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e512041534d296b22312d733434bb54944a4e026f6ddeaa493240cccc429ee9 The package @depro0x/despicable-me was found to contain malicious code. Source: ossf-package-analysis...

CVE-2026-26214 Xiaomi Galaxy FDS Android SDK <= 3.0.8 TLS Hostname Verification Disabled Enables MITM

Galaxy FDS Android SDK XiaoMi/galaxy-fds-sdk-android version 3.0.8 and prior disable TLS hostname verification when HTTPS is enabled the default configuration. In GalaxyFDSClientImpl.createHttpClient, the SDK configures Apache HttpClient with SSLSocketFactory.ALLOWALLHOSTNAMEVERIFIER, which accep...

[SECURITY] Fedora 42 Update: chromium-144.0.7559.132-1.fc42

Chromium is an open-source web browser, powered by WebKit Blink...

GHSA-CFH3-3JMP-RVHC

creationtimestamp| type| source ---|---|--- 2026-02-12 00:25:06+00:00| seen| https://seclists.org/oss-sec/2026/q1/162 2026-02-12 04:10:06+00:00| seen| https://gist.github.com/alon710/8164d166b74f218576799553a77db1a5...

CVE-2026-25990

creationtimestamp| type| source ---|---|--- 2026-02-12 00:25:06+00:00| seen| https://seclists.org/oss-sec/2026/q1/162 2026-02-12 01:51:21+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3memuwtohsr2u 2026-02-12 04:10:06+00:00| seen|...

newbee-mall 加密问题漏洞

newbee-mall is an e-commerce system developed by newbee with open source. newbee-mall has encryption-related vulnerabilities; these vulnerabilities stem from the use of the unsalted MD5 hash algorithm for storing and verifying user passwords. This allows attackers to quickly recover plaintext...

ClipBucket 代码问题漏洞

ClipBucket is an open-source PHP script developed by MacWarrior. It is available for free download and used to create video-sharing websites. Versions of ClipBucket prior to v5.5.3 had code vulnerabilities. These vulnerabilities stemmed from the remote playback feature, which allowed the creation...

CVE-2025-70092

A cross-site scripting XSS vulnerability in the Item Kits function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Item Name parameter...

CVE-2025-70092

A cross-site scripting XSS vulnerability in the Item Kits function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Item Name parameter...

Nikto Web Scanner 2.6.0

Nikto is an Open Source GPL web server scanner which performs comprehensive tests against web servers for multiple items, including thousands of potentially dangerous files/programs, checks for outdated versions of over 1500 server components, and version specific problems on hundreds of servers...

PT-2026-7894

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2025.8.6 authentik versions prior to 2025.10.4 authentik versions prior to 2025.12.4 Description authentik is an open-source identity provider. When using a SAML Source with the 'Verify Assertion Signature' option...