wazuh

This repository is an open-source security platform called Wazuh, which provides unified XDR and SIEM protection for endpoints and cloud workloads. The repository contains various files and templates for issue reporting, testing, and integration with external services. The probable entry points f...

[SECURITY] Fedora 42 Update: chromium-140.0.7339.127-1.fc42

Chromium is an open-source web browser, powered by WebKit Blink...

SourceCodester Student Grading System SQL Injection Vulnerability

SourceCodester Student Grading System is a SourceCodester open source student grading system. A SQL injection vulnerability exists in SourceCodester Student Grading System version 1.0, which stems from incorrect manipulation of the parameter ID in the file /edituser.php, which could lead to a SQL...

personal-security-checklist-1

This repository is an open-source project for a curated checklist of 300+ tips for protecting digital security and privacy in 2022. It is a community-driven project that allows contributors to suggest and submit points to be added, amended, or removed from the list. The project has a code of...

i-Educar code injection vulnerability

i-Educar is a free educational software from Portábilis Open Source. A code injection vulnerability exists in i-Educar 2.10 and earlier versions, which stems from a misuse of the parameter nmtipo in the file /intranet/educarturmatipocad.php, and could lead to a cross-site scripting attack...

[SECURITY] Fedora 41 Update: chromium-140.0.7339.80-1.fc41

Chromium is an open-source web browser, powered by WebKit Blink...

Automated Testing of Broken Authentication Vulnerabilities in Web APIs with AuthREST

We present AuthREST, an open-source security testing tool targeting broken authentication, one of the most prevalent API security risks in the wild. AuthREST automatically tests web APIs for credential stuffing, password brute forcing, and unchecked token authenticity. Empirical results show that...

Number withdrawal

The Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux in the United States. This CVE number has been withdrawn...

MAL-2025-47025 Malicious code in @coveops/abi (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 75499720f09aaa0ee53321facfb199f2c3234acabc101127ae22bbd4fa90bb1d This package was compromised and malicious code added as part of a phishing campaign...

Malicious code in prebid-universal-creative (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 28a458913f2a945444606a3dd030b993b23a6388274a01a2ecdea26478e1b1d9 This package was compromised and malicious code added as part of a phishing campaign...

MAL-2025-47026 Malicious code in prebid (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 14e7380eb0ee7e6be1b7896f1a961c6f7282199fcce42017c4003fc73695ee52 This package was compromised and malicious code added as part of a phishing campaign...

Xen security vulnerabilities

Xen is an open source virtual machine monitor product from Xen Open Source. The product enables different and incompatible operating systems to run on the same computer and supports migration at runtime to ensure uptime and avoid downtime. Xen has a security vulnerability that can be exploited by...

Neo4j MCP Clients & Servers security vulnerabilities

Neo4j MCP Clients & Servers is a protocol for managing large language model contexts in the Neo4j Contrib open source. A security vulnerability exists in Neo4j MCP Clients & Servers, which stems from a DNS rebinding vulnerability that could lead to bypassing same-origin policy protections and...

Erlang/OTP security vulnerabilities

Erlang/OTP is an Erlang/OTP open source library written in JavaScript that handles handling exceptions. The library catches exceptions raised by the node.js built-in API. A security vulnerability exists in Erlang/OTP versions 17.0 through 28.0.3 and versions 27.3.4.3 and 26.2.5.15, which stems fr...

Shell or Nothing: Real-World Benchmarks and Memory-Activated Agents for Automated Penetration Testing

Penetration testing is critical for identifying and mitigating security vulnerabilities, yet traditional approaches remain expensive, time-consuming, and dependent on expert human labor. Recent work has explored AI-driven pentesting agents, but their evaluation relies on oversimplified...

Xen security vulnerabilities

Xen is an open source virtual machine monitor product from Xen Open Source. The product enables different and incompatible operating systems to run on the same computer and supports migration at runtime to ensure uptime and avoid downtime. Xen has a security vulnerability that can be exploited by...

Xen security vulnerabilities

Xen is an open source virtual machine monitor product from Xen Open Source. The product enables different and incompatible operating systems to run on the same computer and supports migration at runtime to ensure uptime and avoid downtime. Xen has a security vulnerability that can be exploited by...

CVE-2025-54123 Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation

Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at /api/v2/hoverfly/middleware endpoint due to insufficient validation and sanitization in user input. The vulnerability exists i...

Adobe Commerce Flaw CVE-2025-54236 Lets Hackers Take Over Customer Accounts

Adobe has warned of a critical security flaw in its Commerce and Magento Open Source platforms that, if successfully exploited, could allow attackers to take control of customer accounts. The vulnerability, tracked as CVE-2025-54236 aka SessionReaper, carries a CVSS score of 9.1 out of a maximum ...

Adobe Commerce Flaw CVE-2025-54236 Lets Hackers Take Over Customer Accounts

Adobe has warned of a critical security flaw in its Commerce and Magento Open Source platforms that, if successfully exploited, could allow attackers to take control of customer accounts. The vulnerability, tracked as CVE-2025-54236 aka SessionReaper, carries a CVSS score of 9.1 out of a maximum ...