CVE-2025-57815 Fides Lacks Brute-Force Protections on Authentication Endpoints

Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Admin UI login endpoint relies on a general IP-based rate limit for all API traffic and lacks specific anti-automation controls designed to protect against brute-force attacks. This could allow attackers to...

Brute Force

Overview ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Brute Force via insufficient protections on the authentication process. An attacker can gain unauthorized access to user accounts by performing automated credential...

[SECURITY] Fedora 42 Update: chromium-140.0.7339.80-1.fc42

Chromium is an open-source web browser, powered by WebKit Blink...

Google Android elevation of privilege vulnerability (CNVD-2025-24495)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to gain higher privileges on the system...

All You Need Is a Fuzzing Brain: an LLM-Powered System for Automated Vulnerability Detection and Patching

Our team, All You Need Is A Fuzzing Brain, was one of seven finalists in DARPA's Artificial Intelligence Cyber Challenge AIxCC, placing fourth in the final round. During the competition, we developed a Cyber Reasoning System CRS that autonomously discovered 28 security vulnerabilities - including...

Online Store Platform Privilege Escalation

The vulnerabilities of the software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B are related to the lack of measures taken to protect the website structure. Exploiting these vulnerabilities can allow attackers to enhance...

Online Store Race Condition

The vulnerability of software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B is related to synchronization errors when using a shared resource. This “race-to-win” scenario allows a malicious actor to circumvent security...

Online Store Cross-site Request Forgery

The vulnerabilities of software platforms for developing and managing online stores like Magento Open Source, Adobe Commerce, and Adobe Commerce B2B are related to the exploitation of cross-site requests. Exploiting these vulnerabilities can allow unauthorized actors to gain unauthorized access t...

Online Store Authentication File Read

The vulnerabilities of the software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B are related to deficiencies in authentication procedures. Exploiting these vulnerabilities can allow attackers to read arbitrary files remote...

Online Store Input Validation DoS

The vulnerabilities of software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B are related to insufficient validation of input data. Exploiting these vulnerabilities can allow attackers to cause service failures...

Sim Studio code injection vulnerability

Sim Studio is an AI agent workflow builder for Sim Studio open source. A code injection vulnerability exists in Sim Studio 1.0.0 and earlier versions, which stems from the fact that incorrect manipulation of the parameter code may lead to code injection...

SQL Injection Vulnerability

pRESTd is an interface to prest open source. A SQL injection vulnerability exists in versions prior to pRESTd 2.0.0-rc3, which stems from insufficient input validation and is vulnerable to SQL injection attacks...

Fides code issue vulnerabilities

Fides is an open source privacy engineering platform open-sourced by Ethyca to manage the implementation of data privacy requests in the runtime environment and the enforcement of privacy regulations in code. A code issue vulnerability exists in Fides versions prior to 2.69.1, which stems from a...

VehiclePassport: a GAIA-X-Aligned, Blockchain-Anchored Privacy-Preserving, Zero-Knowledge Digital Passport for Smart Vehicles

Modern vehicles accumulate fragmented lifecycle records across OEMs, owners, and service centers that are difficult to verify and prone to fraud. We propose VehiclePassport, a GAIA-X-aligned digital passport anchored on blockchain with zero-knowledge proofs ZKPs for privacy-preserving verificatio...

i-Educar Access Control Vulnerability

i-Educar is a free educational software from Portábilis Open Source. An access control error vulnerability exists in i-Educar version 2.10 and earlier, which stems from improper access control in the file /enturmacao-em-lote/...

metasploit-framework

This is an offensive tool for penetration testing. It is the Metasploit Framework, a comprehensive platform for developing and executing exploits. The framework is written in Ruby and provides a wide range of features for penetration testing, including exploit development, vulnerability scanning,...

CVE-2025-58446 xgrammar vulnerable to denial of service by huge enum grammar

xgrammar is an open-source library for efficient, flexible, and portable structured generation. A grammar optimizer introduced in 0.1.23 processes large grammars 100k characters at very low rates, and can be used for DOS of model providers. This issue is fixed in version 0.1.24...

TI_Dos_Framework

This is a comprehensive web-app audit framework called TIDoS Framework. It is a Python-based tool that provides a wide range of modules for reconnaissance, scanning, enumeration, vulnerability analysis, and exploitation. The framework is designed to be user-friendly and provides a simple interfac...

metasploit-framework

This is a Metasploit Framework repository. The Metasploit Framework is an open-source penetration testing platform used for identifying vulnerabilities in computer systems and applications. It is a comprehensive toolset for security professionals to simulate attacks and test defenses. The...

vuls

This is an open-source vulnerability scanner for Linux and FreeBSD, written in Go. It is an agentless scanner, meaning it does not require any additional software to be installed on the target systems. The scanner is designed to be easy to use and provides a simple command-line interface. The...