CVE-2025-66489

Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a TOTP code is provided, potentially gaining unauthorized access to user accounts. This issue exists due to problematic conditional logic in...

ae.teletronics.nlp:entityextraction (>=1.3 <=1.4), ai.driftkit:driftkit-context-engineering-spring-ai-starter (>=0.6.0 <=0.8.7) +3954 more potentially affected by CVE-2025-54988 +1 more via org.apache.tika:tika-core (>=1.13 <=3.2.1)

org.apache.tika:tika-core MAVEN version =1.13, =1.3, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.8.3, =0.8.3, =0.8.3, =0.5.0, =0.5.0, =1.0.0, =1.1.0 - ai.konduit.serving:konduit-serving-cli =0.1.0 - ai.konduit.serving:konduit-serving-distro-bom =0.1.0 - ai.platon.pulsar:pulsar-agentic =4.6.0 and...

[SECURITY] Fedora 43 Update: ubertooth-2020.12.R1-24.fc43

Project Ubertooth is an open source wireless development platform suitable for Bluetooth experimentation. Ubertooth ships with a capable BLE Bluetooth Smart sniffer and can sniff some data from Basic Rate BR Bluetooth Classic connections...

Mayurik dawa-pharma SQL注入漏洞

Mayurik dawa-pharma is an open source pharmacy management system from Mayurik. Mayurik dawa-pharma version 1.0 suffers from a SQL injection vulnerability that originates from an unauthenticated attacker who can execute SQL queries, potentially leading to the disclosure of sensitive information an...

Kalmia 安全漏洞

Kalmia is an open source document content management system from Iridia Solutions Private Limited. A security vulnerability exists in Kalmia version 0.2.0, which stems from the authentication mechanism returning a different error message that could lead to user enumeration...

Silicon Labs Gecko SDK 安全漏洞

The Silicon Labs Gecko SDK GSDK is an open source library from Silicon Labs. Combines the Silicon Labs Wireless Software Development Kit SDK and the Gecko platform into one integrated package. A security vulnerability exists in Silicon Labs Gecko SDK GSDK that stems from a malformed grouping atta...

Composio SDK 安全漏洞

Composio SDK is a developer toolkit from Composio Open Source. A security vulnerability exists in Composio SDK version 0.7.20, which stems from the presence of path traversal in the downloadfileordir function, which could lead to the disclosure of sensitive information...

EUVD-2025-201128

Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a TOTP code is provided, potentially gaining unauthorized access to user accounts. This issue exists due to problematic conditional logic in...

CVE-2025-66453

Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float poing number into the toFixed function, it might lead to high CPU consumption and a potential Denial of Service. Small...

MAL-2025-192268 Malicious code in elf-stats-snowdusted-stockpile-595 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 313c3813ac8880b0dc1f1a973c0125bf17d9f2c700ddc7a009cfc1efbdb54f4b The package elf-stats-snowdusted-stockpile-595 was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-192223 Malicious code in elf-stats-nutmeg-cocoa-967 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec53b5235707d735ff1bece95ce8c4e95266aca2f088ceb1460b2c686ca4616d The package elf-stats-nutmeg-cocoa-967 was found to contain malicious code. Source: ossf-package-analysis...

Vegeta_Vuln_lab

VegetaVulnlab Overview This lab focuses on core penetrati...

Security Bulletin: IBM Automation Decision Services for October 2025 - Multiple CVEs addressed

Summary IBM Automation Decision Services is vulnerable to multiple remote code execution and denial of service attacks in third party and open source used in the product for various functions. See full list below. The vulnerabilities have been addressed Vulnerability Details CVEID:CVE-2025-46653...

Malicious code in karem10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02ecf4d35a03a77c6c6665e814830b4111dd4c3e969a800697b3ca6dc0eeaebc The package karem10 was found to contain malicious code. Source: ossf-package-analysis d2bf23a7af43498c68b78f4d0e45aa2dec25a1ea950bc0c7b9b0d880ec35b9...

A Comprehensive Study on the Impact of Vulnerable Dependencies on Open-Source Software

Open-source libraries are widely used by software developers to speed up the development of products, however, they can introduce security vulnerabilities, leading to incidents like Log4Shell. With the expanding usage of open-source libraries, it becomes even more imperative to comprehend and...

agent-os-server (>=0.4.2 <=0.5.10), aiodatalayer (>=1.0.0 <=2.3.1) +59 more potentially affected by CVE-2025-65896 via asyncmy (>=0.2.10 <=0.2.11)

asyncmy PYPI version =0.2.10, =0.4.2, =1.0.0, =0.5.0, =1.0.8, =2.0.9, =1.0.8, =0.1.0, =1.0.0, =1.3.9, =0.1.1, =0.1.0, =0.2.0, =1.0.0, =0.1.0, =0.3.2 and more Source cves: CVE-2025-65896 Source advisory: OSV:GHSA-QHQW-RRW9-25RM...

CVE-2025-65105

Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor: and --security=selinux: which otherwise put restrictions on operations that containers...

CVE-2025-64750

Removed by vendor...

CVE-2025-51741

An issue was discovered in Veal98 Echo Open-Source Community System 2.2 thru 2.3 allowing an unauthenticated attacker to cause the server to send email verification messages to arbitrary users via the /sendEmailCodeForResetPwd endpoint potentially causing a denial of service to the server or the...

Malicious code in wfui-test-e2e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f560542e2d2fa22d83add8cd46675e252d841fe3b08edfd847677a98547e86a7 The package wfui-test-e2e was found to contain malicious code. Source: ghsa-malware 3440ad1d2e090dbea33cc7a6b8e4cda047b6e20b31fc8bbd3d9e13b1f1758c56...