The vulnerability of the open-source DHCP server software, Kea, arises from the improper use of standard permissions, allowing attackers to expose protected information.

The vulnerability of the open-source DHCP server Kea is related to the improper use of standard permissions. Exploiting this vulnerability can allow a perpetrator to disclose protected information...

openbabel 代码问题漏洞

openbabel is a chemistry toolkit software from Open Babel open source. A code issue vulnerability exists in openbabel 3.1.1 and earlier versions, which stems from a null pointer dereference in the function ChemKinFormat::ReadReactionQualifierLines in the file /src/formats/chemkinformat.cpp, which...

itsourcecode Open Source Job Portal SQL注入漏洞

itsourcecode Open Source Job Portal is itsourcecode open source an enterprise portal site . A SQL injection vulnerability exists in version 1.0 of itsourcecode Open Source Job Portal, which stems from incorrect manipulation of the parameter ID in the file /admin/user/index.php, which could lead t...

H2O Flow Unauthenticated Access

H2O Flow is an open-source user interface for H2O, an open-source, distributed and scalable machine learning and predictive analytics platform. By default, H2O Flow does not require authentication to access the application. This allows an attacker to access sensitive data. This detection is...

PT-2025-39683

Name of the Vulnerable Software and Affected Versions itsourcecode Open Source Job Portal version 1.0 Description A flaw exists in itsourcecode Open Source Job Portal that allows for remote SQL injection. The issue is located in the file /admin/user/index.php?view=edit. Manipulation of the ID...

ogre 安全漏洞

ogre is a scene-oriented 3D engine open-sourced by OGRECave. A security vulnerability exists in ogre 14.4.1 and earlier versions, which originates from a heap buffer overflow in the STBIImageCodec::encode function in the file /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp, which could lead to a...

roncoo-pay 授权问题漏洞

roncoo-pay roncoo payment system is an open source Internet payment system by Lead Class Network RonCoo. An authorization issue vulnerability exists in roncoo-pay, which stems from improper authorization of unknown functions in the file /user/info/lookupList, which could lead to a remote attack...

Malicious code in discord-open-source (npm)

The package discord-open-source was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 8428b55f07242cb67f60ccba8d02146498255552e19df02bb8d05fce64279ac3 This package installs a dependency hosted on a custom domain that run...

MAL-2025-47583 Malicious code in discord-open-source (npm)

The package discord-open-source was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 8428b55f07242cb67f60ccba8d02146498255552e19df02bb8d05fce64279ac3 This package installs a dependency hosted on a custom domain that run...

[SECURITY] Fedora 43 Update: chromium-140.0.7339.185-1.fc43

Chromium is an open-source web browser, powered by WebKit Blink...

Vulnerability-Lookup 跨站脚本漏洞

Vulnerability-Lookup is an open source Vulnerability-Lookup platform for managing disclosure of vulnerabilities. A cross-site scripting vulnerability exists in Vulnerability-Lookup version 2.16.0 that stems from insufficient cleanup of user input and could lead to a cross-site scripting attack...

Horilla 安全漏洞

Horilla is a free and open source human resources software from Horilla Inc. A security vulnerability exists in Horilla versions prior to 1.4.0, which stems from the presence of stored cross-site scripting in the ticket comment editor that could cause a low-privileged user to execute arbitrary...

007putra-my-bot (=1.1.1), 10bis-shufersal-automation (=1.0.0) +4988 more potentially affected by CVE-2025-59343 via tar-fs (>=2.0.0 <=2.1.3)

tar-fs NPM version =2.0.0, =0.2.0, =1.0.0, =1.0.0, =0.107.10, =1.19.19, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.123.2 and more Source cves: CVE-2025-59343 Source advisory: OSV:GHSA-VJ76-C3G6-QR5V...

Every Character Counts: from Vulnerability to Defense in Phishing Detection

Phishing attacks targeting both organizations and individuals are becoming an increasingly significant threat as technology advances. Current automatic detection methods often lack explainability and robustness in detecting new phishing attacks. In this work, we investigate the effectiveness of...

datart 安全漏洞

datart is an open source data visualization open platform by running-elephant. A security vulnerability exists in datart version 1.0.0-rc.3, which stems from the POST /viz/image interface not strictly validating filenames, which could lead to a directory traversal attack...

Claude Code 安全漏洞

Claude Code is an open source proxy coding tool from Anthropic. A security vulnerability exists in versions prior to Claude Code 1.0.39, which stems from the Yarn plugin auto-execution and could lead to bypassing the directory trust dialog...

langfuse 安全漏洞

langfuse is a large language model engineering platform open-sourced by Langfuse. A security vulnerability exists in langfuse that stems from improper authorization of background migration endpoints, which could lead to data corruption or denial of service attacks...

datart 安全漏洞

datart is an open source data visualization open platform by running-elephant. A security vulnerability exists in datart version 1.0.0-rc.3, which stems from mishandling of configuration files and can lead to path traversal and remote code execution...

CyberSOCEval: Benchmarking LLMs Capabilities for Malware Analysis and Threat Intelligence Reasoning

Today's cyber defenders are overwhelmed by a deluge of security alerts, threat intelligence signals, and shifting business context, creating an urgent need for AI systems to enhance operational security work. While Large Language Models LLMs have the potential to automate and scale Security...

CVE-2025-10834

A vulnerability was identified in itsourcecode Open Source Job Portal 1.0. This affects an unknown function of the file /jobportal/admin/login.php. Such manipulation of the argument useremail leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available a...