CVE-2025-15501

A vulnerability was determined in Sangfor Operation and Maintenance Management System up to 3.0.8. Impacted is the function WriterHandle.getCmd of the file /isomp-protocol/protocol/getCmd. This manipulation of the argument sessionPath causes os command injection. Remote exploitation of the attack...

CVE-2025-15501

CVE-2025-15501 affects Sangfor Operation and Maintenance Management System up to v3.0.8. The vulnerability is in the function WriterHandle.getCmd (file /isomp-protocol/protocol/getCmd) where manipulating the argument sessionPath enables OS command injection. Remote exploitation is possible and ex...

CVE-2022-38970

ieGeek IG20 hipcam RealServer V1.0 is vulnerable to Incorrect Access Control. The algorithm used to generate device IDs UIDs for devices that utilize Shenzhen Yunni Technology iLnkP2P suffers from a predictability flaw that allows remote attackers to establish direct connections to arbitrary...

CVE-2025-68718

KAYSUS KS-WR1200 routers with firmware 107 expose SSH and TELNET services on the LAN interface with hardcoded root credentials root:12345678. The administrator cannot disable these services or change the hardcoded password. Changing the management GUI password does not affect SSH/TELNET...

CVE-2026-0643

A flaw has been found in projectworlds House Rental and Property Listing 1.0. Impacted is an unknown function of the file /app/register.php?action=reg of the component Signup. This manipulation of the argument image causes unrestricted upload. Remote exploitation of the attack is possible. The...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000331)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000331 advisory. An infinite loop issue was found in the vhostnet kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handlerx. It could...

CVE-2026-0643

The connected PT-2026-1547 advisory confirms a vulnerability in projectworlds House Rental and Property Listing v1.0, specifically in the Signup component’s /app/register.php?action=reg endpoint. An attacker can manipulate the image parameter to cause unrestricted file upload, enabling remote exp...

CVE-2025-14026 Vulnerable Python version used in Forcepoint One DLP Client

Forcepoint One DLP Client, version 23.04.5642 and possibly newer versions, includes a restricted version of Python 2.5.4 that prevents use of the ctypes library. ctypes is a foreign function interface FFI for Python, enabling calls to DLLs/shared libraries, memory allocation, and direct code...

MAL-2026-88 Malicious code in evm-gateway-contracts-private (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4d7fcec6a0025a21ed0b14bdd643dc22965e7c3ccd6dee0bfa6bf3285b97aac The package evm-gateway-contracts-private was found to contain malicious code. Source: ghsa-malware...

MAL-2026-90 Malicious code in matic-transfer-consumer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2bf4eeb30140d673f8136ab4039e9f3bcc3f3b7d7482e96260a2806bf890eef The package matic-transfer-consumer was found to contain malicious code. Source: ghsa-malware...

CVE-2026-0597

A flaw has been found in Campcodes Supplier Management System 1.0. Affected by this issue is some unknown functionality of the file /retailer/editprofile.php. This manipulation of the argument txtRetailerAddress causes sql injection. Remote exploitation of the attack is possible. The exploit has...

CVE-2026-0597

A flaw has been found in Campcodes Supplier Management System 1.0. Affected by this issue is some unknown functionality of the file /retailer/editprofile.php. This manipulation of the argument txtRetailerAddress causes sql injection. Remote exploitation of the attack is possible. The exploit has...

UBUNTU-CVE-2023-54214

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix potential user-after-free This fixes all instances of which requires to allocate a buffer calling allocskb which may release the chan lock and reacquire later which makes it possible that the chan is...

CVE-2025-15232 Tenda M3 setAdPushInfo formSetAdPushInfo stack-based overflow

A vulnerability was identified in Tenda M3 1.0.0.134903. This vulnerability affects the function formSetAdPushInfo of the file /goform/setAdPushInfo. The manipulation of the argument mac/terminal leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit ...

CVE-2025-15211 code-projects Refugee Food Management System refugee.php sql injection

A flaw has been found in code-projects Refugee Food Management System 1.0. Impacted is an unknown function of the file /home/refugee.php. Executing manipulation of the argument refNo/Fname/Lname/sex/age/contact/nationalitynid can lead to sql injection. The attack can be executed remotely. The...

CVE-2025-15122

CVE-2025-15122 affects JeecgBoot up to 3.9.0. The vulnerability lies in the function loadDatarule under /sys/sysDepartRole/datarule/ , where manipulating arguments departId/roleId causes improper authorization. It can be exploited remotely and is described as high complexity with public exploits....

CVE-2025-15095 postmanlabs httpbin core.py cross site scripting

A security vulnerability has been detected in postmanlabs httpbin up to 0.6.1. This affects an unknown function of the file httpbin-master/httpbin/core.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used...

EUVD-2025-204788

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vikas Ratudi VPSUForm allows Retrieve Embedded Sensitive Data.This issue affects VPSUForm: from n/a through 3.2.24...

MAL-2026-169 Malicious code in secguest-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae83c0c9ae4ffab006e7b6d1833b54dfb5386dedf3e94dedf500b3af1dc82d1c The package secguest-lib was found to contain malicious code. Source: ghsa-malware 62ef36b4b0912fdc42b94702acf5c8e48b06cb2d3370113c3c875479aacd5e9f A...

MAL-2025-192639 Malicious code in smm-youtube (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4dd42b2e1f7dbb24d9031965f83d092b8bb933a52d57fd41846f2434b3ec007 The package smm-youtube was found to contain malicious code. Source: ghsa-malware df910dbfab34e87cf538e77e445f1e2d6add23671c18dd9ecead9e25f2aca789 An...