WordPress plugin FunnelCockpit 跨站脚本漏洞

WordPress FunnelCockpit is an open source tool for tracking and analyzing the entire process of lead generation from initial contact to final closing, developed on the WordPress platform. WordPress FunnelCockpit suffers from a cross-site scripting vulnerability that stems from insufficient input...

CVE-2025-32019

Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed ...

CVE-2025-32019 Harbor's repository description page allows for XSS

Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed ...

Google Launches OSS Rebuild to Expose Malicious Code in Widely Used Open-Source Packages

Google has announced the launch of a new initiative called OSS Rebuild to bolster the security of the open-source package ecosystems and prevent software supply chain attacks. "As supply chain attacks continue to target widely-used dependencies, OSS Rebuild gives security teams powerful data to...

[SECURITY] Fedora 42 Update: firefox-141.0-2.fc42

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

编号撤回

Bun is a Bun open source all-in-one toolkit for JavaScript and TypeScript applications. This CVE number has been withdrawn...

Adobe Commerce Multiple Vulnerabilities (APSB24-61)

The version of Adobe Commerce/Magento Open Source installed on the remote host falls within one of the following ranges 2.4.7.0 2.4.7-p2 Adobe Commerce / 2.4.6.0 2.4.6-p7 Adobe Commerce / 2.4.5.0 2.4.5-p9 Adobe Commerce / 0.x 2.4.4-p10 Adobe Commerce / 2.4.7.0 2.4.7-p2 Magento Open Source / 2.4.6...

Adobe Commerce/Magento Open Source Multiple Vulnerabilities (APSB24-40)

The version of Adobe Commerce/Magento Open Source installed on the remote host falls within one of the following ranges 2.4.7 2.4.7-p1 Adobe Commerce / 2.4.6 2.4.6-p6 Adobe Commerce / 2.4.5 2.4.5-p8 Adobe Commerce / 2.4.4 2.4.4-p9 Adobe Commerce / 2.4.3 2.4.3-ext-8 Adobe Commerce / 2.4.2...

Lastore Daemon 安全漏洞

Lastore Daemon is an open source application from Wuhan deepin Technology Co.,Ltd. A security vulnerability exists in Lastore Daemon version 0.9.53-1 and 0.9.66-1, which stems from improper privilege management and could lead to local elevation of privilege...

Adobe Commerce/Magento Open Source Multiple Vulnerabilities (APSB24-73)

The version of Adobe Commerce/Magento Open Source installed on the remote host falls within one of the following ranges 2.4.7.0 2.4.7-p3 Adobe Commerce / 2.4.6.0 2.4.6-p8 Adobe Commerce / 2.4.5.0 2.4.5-p10 Adobe Commerce / 0.x 2.4.4-p11 Adobe Commerce / 2.4.7.0 2.4.7-p3 Magento Open Source /...

FaultLine: Automated Proof-Of-Vulnerability Generation Using LLM Agents

Despite the critical threat posed by software security vulnerabilities, reports are often incomplete, lacking the proof-of-vulnerability PoV tests needed to validate fixes and prevent regressions. These tests are crucial not only for ensuring patches work, but also for helping developers understa...

Romm 代码问题漏洞

Romm is an open source manager for read-only memory from The RomM Project. A code issue vulnerability exists in Romm 4.0.0-beta.3 and prior versions that stems from improper access control of the /api/saves endpoint, which could lead to arbitrary file writes and remote code execution...

In-Context Learning of Vision Language Models for Detection of Physical and Digital Attacks against Face Recognition Systems

Recent advances in biometric systems have significantly improved the detection and prevention of fraudulent activities. However, as detection methods improve, attack techniques become increasingly sophisticated. Attacks on face recognition systems can be broadly divided into physical and digital...

CVE-2025-54076

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in versions prior to 3.4.6 in the precadastroatendido.php endpoint of the WeGIA application. This vulnerability allows attacke...

CVE-2025-54077

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in versions prior to 3.4.6 in the personalizacao.php endpoint of the WeGIA application. This vulnerability allows attackers to...

CVE-2025-54078

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in versions prior to 3.4.6 in the personalizacaoimagem.php endpoint of the WeGIA application. This vulnerability allows...

[SECURITY] Fedora 41 Update: chromium-138.0.7204.157-1.fc41

Chromium is an open-source web browser, powered by WebKit Blink...

CVE-2025-54058

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.4.6 in the idatendidofamiliares parameter of the /html/funcionario/dependenteeditarEndereco.php endpoint. This vulnerability...

CVE-2025-53938

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. An Authentication Bypass vulnerability was identified in the /dao/verificarrecursoscargo.php endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows unauthenticated...

CVE-2025-53936

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the personalizacaoselecao.php endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers...