CVE-2026-25993 EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys

EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / requestpath values—derived from the urlkey stored in the database—into SQL statements via string concatenation and passes them to execute. As a result, if a malicio...

XWiki Platform Skin Skinx Data Compromise

The vulnerability of the org.xwiki.platform:xwiki-platform-skin-skinx component of the XWiki Platform framework is related to errors in processing the relative path to the directory. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality of protected...

CVE-2025-39984 net: tun: Update napi->skb after XDP process

In the Linux kernel, the following vulnerability has been resolved: net: tun: Update napi-skb after XDP process The syzbot report a UAF issue: BUG: KASAN: slab-use-after-free in skbresetmacheader include/linux/skbuff.h:3150 inline BUG: KASAN: slab-use-after-free in napifragsskb net/core/gro.c:723...

EUVD-2023-48545

Malicious code in bioql PyPI...

FortiWeb web applications Path Traversal

The vulnerability of FortiWeb web applications’ network firewalls is related to errors in the mechanism for processing the relative path to the catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially created requests...

CVE-2025-43375

The Xcode integrated development environment for macOS is vulnerable to a denial of service flaw within the Dev Tools component. The root cause is improper input validation , specifically the copying of buffers without verifying the size of the input data. Processing an overly large path value ca...

PT-2025-32978

Name of the Vulnerable Software and Affected Versions: Bouncy Castle for Java versions 1.44 through 1.78 BCPKIX FIPS versions 1.0.0 through 1.0.7 BCPKIX FIPS versions 2.0.0 through 2.0.7 Description: The Bouncy Castle for Java cryptographic libraries contain a vulnerability related to excessive...

JetBrains TeamCity Path Traversal

The vulnerability of the Continuous Integration and Application Delivery system CI/CD of JetBrains TeamCity is related to errors in processing the relative path to the directory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

kernel: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix malformed packet sizing in vmxnet3processxdp vmxnet3 driver's XDP handling is buggy for packet sizes using ring0 that is, packet sizes between 128 - 3k bytes. We noticed MTU-related connectivity issues with Cilium's...

perl.rte Code Execution

The vulnerability of the perl.rte package on the IBM AIX operating system is related to errors in processing the relative path to the directory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2025-49795

A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service...

CommuniGate Pro Path Traversal Unauthorized Access

The vulnerability of the CommuniGate Pro mail server is related to errors in processing the relative path to the directory. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information by increasing privileges...

FortiManager CLI File Deletion

The vulnerability of the CLI command-line interface of the Fortinet FortiManager device management software, as well as the FortiAnalyzer and FortiAnalyzer-BigData event monitoring and analysis tools, is related to errors in processing the relative path to the directory. Exploiting this...

JetBrains TeamCity Path Traversal

The vulnerability of the Continuous Integration and Deployment Application Delivery system CI/CD of TeamCity in JetBrains is related to errors in processing the relative path to the directory. Exploiting this vulnerability can allow a malicious actor to access protected information through server...

Microsoft Defender for Endpoint Linux Path Traversal

The vulnerability of Microsoft Defender for Endpoint on Linux operating systems is related to errors in processing the relative path to the directory. Exploiting this vulnerability can allow attackers to perform spear-phishing attacks...

unzip Heap Buffer Overflow DoS

The vulnerability of the unzip method in Toshiba e-STUDIO microprogrammed devices is related to errors in processing the relative path to the catalog. Exploiting this vulnerability allows an attacker to execute arbitrary code, create new files, or overwrite existing ones...

PT-2024-4481 · Smartec +1 · Smartec St-Fr041Me +2

Name of the Vulnerable Software and Affected Versions: ZkTeco ProFace X versions ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others Smartec ST-FR043 versions ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others Smartec ST-FR041ME versions ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others...

PowerPanel Business Path Traversal Code Execution

The vulnerability of the PowerPanel Business monitoring and power source management system is related to errors in processing the relative path to the catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created zip file...

CData Arc Embedded Jetty Unauthorized Access

The vulnerability of the embedded Jetty server in the CData Arc ArcESB business process automation platform is related to errors in processing the relative path to the catalog. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected...

Dell Unity Operating Environment Path Traversal

The vulnerability of the operating environment for managing and maintaining Dell Unity Operating Environment OE storage involves errors in processing the relative path to the directory. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to write...