Horilla security vulnerabilities

Horilla is a free and open source human resources software from Horilla Inc. A security vulnerability exists in Horilla versions prior to 1.4.0, which stems from the presence of stored cross-site scripting in the ticket comment editor that could cause a low-privileged user to execute arbitrary...

datart security vulnerabilities

datart is an open source data visualization open platform by running-elephant. A security vulnerability exists in datart version 1.0.0-rc.3, which stems from mishandling of configuration files and can lead to path traversal and remote code execution...

CyberSOCEval: Benchmarking LLMs Capabilities for Malware Analysis and Threat Intelligence Reasoning

Today's cyber defenders are overwhelmed by a deluge of security alerts, threat intelligence signals, and shifting business context, creating an urgent need for AI systems to enhance operational security work. While Large Language Models LLMs have the potential to automate and scale Security...

langfuse security vulnerabilities

langfuse is a large language model engineering platform open-sourced by Langfuse. A security vulnerability exists in langfuse that stems from improper authorization of background migration endpoints, which could lead to data corruption or denial of service attacks...

datart security vulnerabilities

datart is an open source data visualization open platform by running-elephant. A security vulnerability exists in datart version 1.0.0-rc.3, which stems from the POST /viz/image interface not strictly validating filenames, which could lead to a directory traversal attack...

Claude Code security vulnerabilities

Claude Code is an open source proxy coding tool from Anthropic. A security vulnerability exists in versions prior to Claude Code 1.0.39, which stems from the Yarn plugin auto-execution and could lead to bypassing the directory trust dialog...

Every Character Counts: from Vulnerability to Defense in Phishing Detection

Phishing attacks targeting both organizations and individuals are becoming an increasingly significant threat as technology advances. Current automatic detection methods often lack explainability and robustness in detecting new phishing attacks. In this work, we investigate the effectiveness of...

CVE-2025-10834

A vulnerability was identified in itsourcecode Open Source Job Portal 1.0. This affects an unknown function of the file /jobportal/admin/login.php. Such manipulation of the argument useremail leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available a...

CVE-2025-10834

A vulnerability was identified in itsourcecode Open Source Job Portal 1.0. This affects an unknown function of the file /jobportal/admin/login.php. Such manipulation of the argument useremail leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available a...

CVE-2025-10834 itsourcecode Open Source Job Portal login.php sql injection

A vulnerability was identified in itsourcecode Open Source Job Portal 1.0. This affects an unknown function of the file /jobportal/admin/login.php. Such manipulation of the argument useremail leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available a...

CVE-2025-10834 itsourcecode Open Source Job Portal login.php sql injection

A vulnerability was identified in itsourcecode Open Source Job Portal 1.0. This affects an unknown function of the file /jobportal/admin/login.php. Such manipulation of the argument useremail leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available a...

Our plan for a more secure npm supply chain

Open source software is the bedrock of the modern software industry. Its collaborative nature and vast ecosystem empower developers worldwide, driving efficiency and progress at an unprecedented scale. This scale also presents unique vulnerabilities that are continually tested and under attack by...

SourceCodester Pet Grooming Management Software security vulnerabilities

SourceCodester Pet Grooming Management Software is an open source pet grooming management system from SourceCodester. A security vulnerability exists in version 1.0 of SourceCodester Pet Grooming Management Software, which stems from an incorrect manipulation of the parameter barcode in the file...

CVE-2025-10834: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in itsourcecode Open Source Job Portal 1.0. This affects an unknown function of the file /jobportal/admin/login.php. Such manipulation of the argument useremail leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available a...

Adobe Commerce/Magento Open Source Improper Input Validation (APSB25-88)

The version of Adobe Commerce/Magento Open Source installed on the remote host it is, therefore, affected by a vulnerability as referenced in the APSB25-88 advisory. - Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper...

Semantic-Aware Fuzzing: an Empirical Framework for LLM-Guided, Reasoning-Driven Input Mutation

Security vulnerabilities in Internet-of-Things devices, mobile platforms, and autonomous systems remain critical. Traditional mutation-based fuzzers -- while effectively explore code paths -- primarily perform byte- or bit-level edits without semantic reasoning. Coverage-guided tools such as AFL+...

PT-2025-39200

Name of the Vulnerable Software and Affected Versions DNN formerly DotNetNuke versions prior to 10.1.0 Description DNN formerly DotNetNuke is an open-source web content management platform. Versions prior to 10.1.0 have a javascript injection issue related to specially crafted URLs to the...

Flowise code issue vulnerabilities

Flowise is a FlowiseAI open source tool for easily building LLM applications. A code issue vulnerability exists in Flowise version 3.0.5, which stems from a server-side request forgery in the /api/v1/fetch-links endpoint that could allow an attacker to use the server as a proxy to access internal...

Flowise code injection vulnerability

Flowise is a FlowiseAI open source tool for easily building LLM applications. A cross-site scripting vulnerability exists in Flowise version 3.0.5, which originates from a CustomMCP node directly executing user-entered JavaScript code and can be exploited by an attacker to cause remote code...

Static Security Vulnerability Scanning of Proprietary and Open-Source Software: an Adaptable Process with Variants and Results

Software vulnerabilities remain a significant risk factor in achieving security objectives within software development organizations. This is especially true where either proprietary or open-source software OSS is included in the technological environment. In this paper an end-to-end process with...