CVE-2025-65995

creationtimestamp| type| source ---|---|--- 2025-12-12 15:00:38+00:00| seen| https://seclists.org/oss-sec/2025/q4/271 2025-12-12 16:31:20+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m7sj7clvqm24...

CVE-2025-66388

creationtimestamp| type| source ---|---|--- 2025-12-12 14:58:13+00:00| seen| https://seclists.org/oss-sec/2025/q4/270 2025-12-12 16:36:20+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m7sjibnppw2e 2025-12-15 13:44:35+00:00| seen|...

[SECURITY] Fedora 42 Update: singularity-ce-4.3.5-1.fc42

SingularityCE is the Community Edition of Singularity, an open source container platform designed to be simple, fast, and secure...

[SECURITY] Fedora 43 Update: singularity-ce-4.3.5-1.fc43

SingularityCE is the Community Edition of Singularity, an open source container platform designed to be simple, fast, and secure...

CVE-2025-67818

A path traversal vulnerability exists in Weaviate OSS before version 1.33.4 . An attacker with permissions to insert data into the database can craft an entry name containing an absolute path or parent directory traversal sequences (e.g., ../../..). When a backup is subsequently restored, this al...

CVE-2025-67819

An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files...

gardenctl-v2 command injection vulnerability

gardenctl-v2 is an open source command line client for Gardener. A command injection vulnerability exists in gardenctl-v2 that stems from a non-POSIX shell environment that can forge credential values, potentially leading to credential disclosure...

CVE-2025-67511

Cybersecurity AI CAI is an open-source framework for building and deploying AI-powered offensive and defensive automation. Versions 0.5.9 and below are vulnerable to Command Injection through the runsshcommandwithcredentials function, which is available to AI agents. Only password and command...

CVE-2025-66446

MaxKB is an open-source AI assistant for enterprise. Versions 2.3.1 and below have improper file permissions which allow attackers to overwrite the built-in dynamic linker and other critical files, potentially resulting in privilege escalation. This issue is fixed in version 2.4.0...

CVE-2025-66419

CVE-2025-66419 affects MaxKB: the tool module in versions 2.3.1 and earlier allows an attacker to escape the sandbox and escalate privileges under certain concurrent conditions. Consequences are privilege elevation and potential broader impact within affected deployments. The issue has a fixed re...

MaxKB race condition issue

MaxKB is a 1Panel-dev open source open source knowledge base question and answer system based on a large language model and RAG. A competitive condition issue vulnerability exists in MaxKB 2.3.1 and earlier versions, which stems from a tool module that allows an attacker to escape the sandbox...

OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability

OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request...

CVE-2025-66002

creationtimestamp| type| source ---|---|--- 2025-12-10 17:35:32+00:00| seen| https://seclists.org/oss-sec/2025/q4/261 2025-12-10 19:34:55+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m7nsjqo4p62g 2025-12-11 02:23:14+00:00| seen|...

CVE-2025-66508

1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.14 and below use Gin's default configuration which trusts all IP addresses as proxies TrustedProxies = 0.0.0.0/0, allowing any client to spoof the X-Forwarded-For header. Since all IP-based access controls...

CVE-2025-66507

1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.13 and below allow an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA...

[SECURITY] Fedora 43 Update: imhex-1.37.4-3.fc43

ImHex is a Hex Editor, a tool to display, decode and analyze binary data to reverse engineer their format, extract informations or patch values in them. What makes ImHex special is that it has many advanced features that can often only be found in paid applications. Such features are a completely...

[SECURITY] Fedora 42 Update: imhex-1.37.4-3.fc42

ImHex is a Hex Editor, a tool to display, decode and analyze binary data to reverse engineer their format, extract informations or patch values in them. What makes ImHex special is that it has many advanced features that can often only be found in paid applications. Such features are a completely...

Canonical Apport security vulnerability

Canonical apport is an open source crash reporting tool from Canonical. A security vulnerability exists in Canonical apport that stems from improper group ownership settings when the crash reporting tool creates crash files, which could lead to the disclosure of crash information...

pipeshub-ai code issues and vulnerabilities

pipeshub-ai is an enterprise automation platform open-sourced by PipesHub AI - The Open Source Alternative to Glean. A code issue vulnerability exists in versions prior to pipeshub-ai 0.1.0-beta, which stems from a lack of authentication and could allow an attacker to remotely overwrite files or...

XiangShan security vulnerabilities

XiangShan is an open source high performance RISC-V processor project open sourced by XiangShan in China. A security vulnerability exists in XiangShan that stems from speculative execution and indirect branch prediction that could lead to a side-channel analysis attack...