EUVD-2025-24646

Malicious code in bioql PyPI...

EUVD-2025-24834

Malicious code in bioql PyPI...

EUVD-2025-25624

Malicious code in bioql PyPI...

GHSA-26F6-WM47-7H7J Duplicate Advisory: motionEye vulnerable to RCE via unsanitized motion config parameter

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-j945-qm58-4gjx. This link is maintained to preserve external references. Original Description MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as imagefilenam...

UBUNTU-CVE-2025-54291

Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses...

Lobe Chat 跨站脚本漏洞

Lobe Chat is an open source, high-performance chatbot framework open sourced from LobeHub. A cross-site scripting vulnerability exists in Lobe Chat versions prior to 1.129.4 that stems from the SVGRender component's use of dangerouslySetInnerHTML to process SVG content, which could lead to...

Linux Distros Unpatched Vulnerability : CVE-2024-28831

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Stored XSS in some confirmation pop-ups in Checkmk before versions 2.3.0p7 and 2.2.0p28 allows Checkmk users to execute arbitrary scripts by injecting HTML...

Ivanti多款产品 安全漏洞

Ivanti Connect Secure ICS and others are products of Ivanti Corporation, U.S.A. Ivanti Connect Secure is a secure remote network connection tool.Ivanti Policy Secure IPS is a network access control NAC solution.Ivanti Neurons is Ivanti Neurons is a groundbreaking platform that simplifies and...

CVE-2025-58374 Roo Code: Auto-approve allows npm install execution of malicious postinstall scripts

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a default list of allowed commands that do not need manual approval if auto-approve is enabled, and npm install is included in that list. Because npm install executes lifecycle...

CVE-2023-21475

CVE-2023-21475 is an out-of-bounds write vulnerability in the libaudiosaplus_sec.so library present on Samsung Mobile devices prior to SMR Apr-2023 Release 1. The issue allows a local attacker to execute arbitrary code via a vulnerability in the affected library; exploitation status is not detail...

SAMSUNG Mobile devices 安全漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Mobile devices versions prior to SMR Sep-2025 Release 1, which stems from improper privilege management and...

Linux Distros Unpatched Vulnerability : CVE-2023-0818

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Off-by-one Error in GitHub repository gpac/gpac prior to v2.3.0-DEV. CVE-2023-0818 Note that Nessus relies on the presence of the package as reported by the...

CVE-2025-58334

In JetBrains IDE Services before 2025.5.0.1086, 2025.4.2.2164 users without appropriate permissions could assign high-privileged role for themselves...

CVE-2025-34161

CVE-2025-34161 affects Coolify versions prior to v4.0.0-beta.420.7. A remote code execution flaw exists in the project deployment workflow: authenticated users with low privileges can inject arbitrary shell commands through the Git Repository field during project creation, leading to arbitrary co...

CVE-2025-55293

Meshtastic (vulnerable before 2.6.3) allows crafting NodeInfo packets to overwrite a known node’s publicKey in NodeDB. Attack flow: first send NodeInfo with an empty publicKey to bypass size checks (clears existing key), then send a new key that gets stored. Root cause is improper handling of emp...

Linux Distros Unpatched Vulnerability : CVE-2023-43796

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This...

NamelessMC 安全漏洞

NamelessMC is a free, easy to use and powerful website software from the NamelessMC team. Suitable for your Minecraft server, it contains tons of features. A security vulnerability exists in NamelessMC versions prior to 2.2.3, which stems from a cross-site scripting vulnerability that could lead ...

Linux Distros Unpatched Vulnerability : CVE-2022-3330

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - It was possible for a guest user to read a todo targeting an inaccessible note in Gitlab CE/EE affecting all versions from 15.0 prior to 15.2.5, 15.3 prior to...

PT-2025-33493 · Plane · Plane

Name of the Vulnerable Software and Affected Versions: Plane versions prior to 0.28.0 Description: Plane is open-source project management software. A stored cross-site scripting XSS vulnerability exists in the description html field. This flaw allows an attacker to inject malicious JavaScript co...

PT-2025-33432 · Lemon S · Lemonos

Name of the Vulnerable Software and Affected Versions: LemonOS versions prior to nightly-2024-07-13 Description: A stack-based buffer overflow issue exists in the HTTP Client component of LemonOS. The HTTPGet function within the /Applications/Steal/main.cpp file is affected, specifically due to...