Unity Linux 20.1070e Security Update: ffmpeg (UTSA-2025-936088)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-936088 advisory. A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the avdictset function in dict.c. Tenable has extracted the preceding description bloc...

WordPress Featured Image from URL (FIFU) plugin <= 5.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image Custom Fields vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Featured Image Custom Fields vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Featured Image from URL versions = 5.2.7...

CVE-2025-11336 Four-Faith Water Conservancy Informatization Platform download.do;otherlogout.do path traversal

A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. Affected by this issue is some unknown functionality of the file /stAlarmConfigure/index.do/../../aloneReport/download.do;otherlogout.do. Such manipulation of the argument fileName leads...

CVE-2025-59830

Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its paramslimit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters...

AllStarLink Supermon 代码注入漏洞

AllStarLink Supermon is a web front-end management and monitoring tool from AllStarLink. A code injection vulnerability exists in AllStarLink Supermon 6.2 and earlier versions, which stems from unknown code in the AllMon2 component that could lead to a cross-site scripting attack...

EUVD-2022-34011

Malicious code in bioql PyPI...

EUVD-2025-31675

Malicious code in bioql PyPI...

EUVD-2025-31260

Malicious code in bioql PyPI...

EUVD-2023-58997

Malicious code in bioql PyPI...

EUVD-2025-30932

Malicious code in bioql PyPI...

EUVD-2025-27724

Malicious code in bioql PyPI...

EUVD-2025-29862

Malicious code in bioql PyPI...

EUVD-2025-28055

Malicious code in bioql PyPI...

EUVD-2025-28017

Malicious code in bioql PyPI...

EUVD-2025-28555

Malicious code in bioql PyPI...

EUVD-2025-25105

Malicious code in bioql PyPI...

EUVD-2025-32370

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

CVE-2025-9895

The Notification Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the 'subscriber-list-empty.php' file. This makes it possible for unauthenticated attackers to empty the subscrib...

MeteoBridge template.cgi command injection

Added: 10/03/2025 CVE: CVE-2025-4008 Background MeteoBridge is a device which connects personal weather stations to public weather networks. Problem A command injection vulnerability in the MeteoBridge web interface could allow remote, unauthenticated attackers to execute arbitrary commands by...

Kissflow Work Platform 安全漏洞

Kissflow Work Platform is a low-code process automation platform from Kissflow, Inc. in the United States. A security vulnerability exists in Kissflow Work Platform versions v2.0 through v4.2, which originates from the injection of a specially crafted payload and could lead to a stored cross-site...