Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001658)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001658 advisory. The tcpmssmanglepacket function in net/netfilter/xtTCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003417)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003417 advisory. The docheck function in kernel/bpf/verifier.c in the Linux kernel before 4.11.1 does not make the allowptrleaks value available for restricting the output of the...

CVE-2018-18447

dotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data issue 2 of 2...

CVE-2025-40807

A vulnerability has been identified in Gridscale X Prepay All versions V4.2.1. The affected application is vulnerable to capture-replay of authentication tokens. This could allow an authenticated but already locked-out user to establish still valid user sessions...

CVE-2025-40831

SINEC Security Monitor prior to V4.10.0 is affected by an input validation flaw in the date parameter of the report generation function. This could allow an authenticated, low-priv attacker to cause a denial-of-service condition in the report feature. Mitigation: upgrade to V4.10.0 or later (per ...

CVE-2025-62612

The CVE-2025-62612 advisory concerns FastGPT prior to version 4.11.1, where the workflow file reading node does not verify the security of the network link, enabling potential SSRF attacks. Multiple connected sources corroborate the issue as a FastGPT SSRF in the workflow file reading node with u...

CVE-2025-34281

ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting XSS vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if t...

CVE-2025-61926 Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret

Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret. The value used for the secret token was compiled into the Allstar binary an...

Linux Distros Unpatched Vulnerability : CVE-2016-4998

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The IPTSOSETREPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service...

Genealogy 跨站脚本漏洞

Genealogy is a genealogy PHP application from the individual developer of KREAWEB.be. A cross-site scripting vulnerability exists in Genealogy versions prior to 4.4.0, which stems from a reflective cross-site scripting vulnerability that could lead to session hijacking and data theft...

CVE-2025-4285

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Rolantis Information Technologies Agentis allows SQL Injection. This issue affects Agentis: before 4.32...

OpenCV 安全漏洞

OpenCV is an open source, cross-platform, lightweight computer vision library from OpenCV Open Source. A security vulnerability exists in OpenCV versions prior to 4.12.0, which stems from an uninitialized pointer variable that could result in an arbitrary heap buffer write...

CVE-2025-40721

Reflected Cross-site Scripting XSS vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL trhough the idfactura parameter in /FacturaE/listadofacturasficha.jsp...

Dell OpenManage Enterprise 代码注入漏洞

Dell OpenManage Enterprise is an easy-to-use, one-to-many system management console for IT infrastructure management from Dell, Inc. The software enables cost-effective, comprehensive lifecycle management of Dell EMC PowerEdge servers from a single console. A code injection vulnerability exists i...

Ivanti Cloud Services Appliance 安全漏洞

The Ivanti Cloud Services Appliance Csa is an Internet appliance from Ivanti Corporation, USA. It provides secure communications and functionality over the Internet. A security vulnerability exists in the Ivanti Cloud Services Appliance prior to version 4.6, which stems from the inclusion of an...

PT-2024-29299 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 4.1.0 Description: The issue allows a local attacker to upgrade common permissions to root and leak sensitive information through a use-after-free vulnerability. This could potentially lead to system compromise...

WordPress Category Posts Widget < 4.9.17- Admin+ Stored XSS vulnerability

WordPress Category Posts Widget 4.9.17- Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Category Posts Widget versions 4.9.17...

PT-2024-26926 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 4.0.0 OpenHarmony version 4.0.0 Description: The issue allows a remote attacker to execute arbitrary code in pre-installed apps through out-of-bounds read and write. Recommendations: For OpenHarmony versions prio...

AZL-43018 CVE-2024-29038 affecting package tpm2-tools for versions less than 4.3.2-2

tpm2-tools is the source repository for the Trusted Platform Module TPM2.0 tools. A malicious attacker can generate arbitrary quote data which is not detected by tpm2 checkquote. This issue was patched in version 5.7...

ProcessMaker 安全漏洞

ProcessMaker is a Php-written site builder for business process management BPM and workflow management from ProcessMaker, Inc. in the United States. A security vulnerability exists in ProcessMaker versions prior to 4.0 that stems from the presence of a cross-site scripting vulnerability that coul...