CVE-2025-58148

creationtimestamp| type| source ---|---|--- 2025-10-21 10:02:37+00:00| seen| https://seclists.org/oss-sec/2025/q4/65 2025-10-21 12:35:52+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m3pdsf3t522b...

ChurchCRM Authentication Error Vulnerability

ChurchCRM is ChurchCRM open source an open source CRM system for churches. ChurchCRM 5.18.0 and earlier versions have an authentication error vulnerability that stems from a lack of authentication in the AuthMiddleware function in the API Endpoint component, which can be exploited by an attacker ...

GI-DocGen Cross-Site Scripting Vulnerability

GI-DocGen is an open source document generation library for GNOME. GI-DocGen suffers from a cross-site scripting vulnerability that stems from susceptibility to cross-site scripting attacks that could lead to the execution of JavaScript code in a web environment...

CVE-2025-62528

Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to put JavaScript in name or description fields which would run on project load. This issue has been patched in version 1.5.0...

EUVD-2025-35097

Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for an attacker to request password reset email containing a malicious link, allowing the attacker to set the email if clicked by the victim. This issue has been...

MAL-2025-48526 Malicious code in taxify-work-profile (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46f9db2231e68ebc03c3b566274d3bd3c0d6510f29c5eec6c83c1fa41806009a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[SECURITY] Fedora 42 Update: chromium-141.0.7390.107-1.fc42

Chromium is an open-source web browser, powered by WebKit Blink...

Cybersecurity AI: Evaluating Agentic Cybersecurity in Attack/Defense CTFs

We empirically evaluate whether AI systems are more effective at attacking or defending in cybersecurity. Using CAI Cybersecurity AI's parallel execution framework, we deployed autonomous agents in 23 Attack/Defense CTF battlegrounds. Statistical analysis reveals defensive agents achieve 54.3%...

DataEase H2 JDBC Injection Code Execution Vulnerability

DataEase is a set of Java-based development of open source data visualization and analysis tools to help users quickly analyze data and insight into business trends , so as to achieve business improvement and optimization . DataEase H2.java handles JDBC connection validation with a code injection...

ROS-20251020-01

Vulnerability in open source external resource management software Terraform is associated with an incorrect restriction on the path name of a restricted directory. Exploitation of the vulnerability could allow an attacker to download arbitrary files...

Multimodal Safety Is Asymmetric: Cross-Modal Exploits Unlock Black-Box MLLMs Jailbreaks

Multimodal large language models MLLMs have demonstrated significant utility across diverse real-world applications. But MLLMs remain vulnerable to jailbreaks, where adversarial inputs can collapse their safety constraints and trigger unethical responses. In this work, we investigate jailbreaks i...

JLSEC-2025-95

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...

OSV-2025-845 Global-buffer-overflow in icaltime_day_of_year

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=452914686 Crash type: Global-buffer-overflow READ 4 Crash state: icaltimedayofyear expandyeardays iteratorsetstart...

Toeverything AFFiNE 代码注入漏洞

Toeverything AFFiNE is a knowledge management software from Toeverything open source. AFFiNE 0.24.1 and earlier versions suffer from a code injection vulnerability that stems from an unknown code flaw in the Avatar Upload Image Endpoint component, which could lead to a cross-site scripting attack...

CuPs (>=0.0.0 <=0.0.5), IF (=0.0.0) +110 more potentially affected by unknown CVE via unic-ucd-segment (>=0.7.0 <=0.9.0)

unic-ucd-segment CARGO version =0.7.0, =0.0.0, =1.11.3, =0.3.0, =0.1.0, =0.5.0, =0.5.0, =0.3.0, =1.0.0, =0.1.0, =0.0.4, =0.1.0, =0.2.6, =0.0.15, =0.2.11 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0104...

[SECURITY] Fedora 42 Update: firefox-144.0-3.fc42

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

Dify 跨站脚本漏洞

Dify is an open source LLM application development platform from LangGenius Open Source. A cross-site scripting vulnerability exists in Dify 1.9.1 and earlier versions, which stems from a failure to validate or clean up the authorizationurl in the implementation of the OAuth process, which could...

DataEase 代码问题漏洞

DataEase is a set of Java-based development of open source data visualization and analysis tools to help users quickly analyze data and insight into business trends , so as to achieve business improvement and optimization . A code injection vulnerability exists in DataEase DB2/MongoDB JDBC...

Flowise 安全漏洞

Flowise is a FlowiseAI open source tool for easily building LLM applications. A security vulnerability exists in Flowise 3.0.4 and earlier versions, which stems from a Supabase RPC Filter field that is not cleaned and escaped from user input, which could lead to remote code execution...

ClipBucket 路径遍历漏洞

ClipBucket is an open source and freely downloadable PHP script from MacWarrior Open Source. It is used for sharing video sites. A path traversal vulnerability exists in ClipBucket version 5.5.2 - 146, which stems from insufficient validation of file load paths and could lead to a path traversal...