CVE-2025-54867

Youki is a container runtime written in Rust. Prior to version 0.5.5, if /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem. This issue has been patched in version 0.5.5...

CVE-2025-8046 Injection Guard < 1.2.8 - Reflected XSS via $_SERVER['REQUEST_URI']

The Injection Guard WordPress plugin before 1.2.8 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...

CVE-2025-20025

CVE-2025-20025 concerns the TinyCBOR library maintained by Intel. Affected are TinyCBOR builds before version 0.6.1, where uncontrolled recursion may allow an authenticated local user to cause a denial of service. Documented impact includes potential resource exhaustion and system crash; CVSS met...

CVE-2025-55150 Stirling-PDF SSRF vulnerability on /api/v1/convert/html/pdf

Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/html/pdf endpoint to convert HTML to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security sanitization...

Exploit for Code Injection in Xwiki

PoC for CVE-2025-24893 — XWiki Remote Code Execution Safe PoC...

CrushFTP 安全漏洞

CrushFTP is a file transfer server from CrushFTP, Inc. A security vulnerability exists in CrushFTP versions prior to 10.8.5 and prior to 11.3.423, which stems from improper handling of AS2 authentication and could allow a remote attacker to gain administrator privileges...

pycares 资源管理错误漏洞

pycares is a python library by the individual developers at saghul. A resource management error vulnerability exists in pycares versions prior to 4.9.0, which stems from post-release reuse and may cause the interpreter to crash...

CVE-2024-34400

An issue was discovered in VirtoSoftware Virto Kanban Board Web Part before 5.3.5.1 for SharePoint 2019. There is /layouts/15/Virto.KanbanTaskManager/api/KanbanData.ashx LinkTitle2 XSS...

CVE-2024-8031

The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authenticated attackers, with admin-level access and above, to download arbitrary files that may contain sensitive information like wp-config.php...

Intel PROSet/Wireless WiFi 资源管理错误漏洞

Intel PROSet/Wireless WiFi is a wireless network card driver from Intel Corporation USA. A resource management error vulnerability exists in Intel PROSet/Wireless WiFi versions prior to 23.100, which stems from reuse after release and could lead to a denial of service attack...

Progress Sitefinity 代码问题漏洞

Progress Sitefinity is an open source platform for building corporate websites and intranets from Progress, Inc. A code issue vulnerability exists in Progress Sitefinity that stems from insufficient session expiration and could lead to a session replay attack. The following versions are affected:...

CVE-2025-22458

DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated attacker to escalate to System...

SUSE CVE-2025-29922

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability allows creating or deleting an object via the APIExport VirtualWorkspace in any arbitrary target workspace for pre-existing resources. By...

Malicious code in msgspec-python313-pre (PyPI)

--- -= Per source details. Do not edit below this line.=-...

OpenBSD 安全漏洞

OpenBSD is a cross-platform, BSD-based UNIX-like operating system from the Canadian OpenBSD organization. A security vulnerability exists in OpenBSD versions prior to 7.6 errata 006 and prior to 7.5 errata 015, which stems from wg4 traffic that could cause the kernel to crash...

PT-2025-12365

Name of the Vulnerable Software and Affected Versions kcp versions prior to 0.26.3 Description The issue allows creating or deleting an object via the APIExport VirtualWorkspace in any arbitrary target workspace for pre-existing resources, even if there is no APIBinding in that workspace or the...

QNAP Systems QTS和QNAP Systems QuTS hero 代码注入漏洞

QNAP Systems QTS and QNAP Systems QuTS hero are both products of China Weilian Technology QNAP Systems.QNAP Systems QTS is an entry operating system.QNAP Systems QuTS hero is an operating system. A code injection vulnerability exists in QNAP Systems QTS prior to version 5.2.3.3006 build 20250108...

AZL-57177 CVE-2025-27144 affecting package telegraf for versions less than 1.29.4-13

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE...

Kwik 安全漏洞

Kwik is a client and server that implements the QUIC protocol RFC 9000 by the individual developer Peter Doornbosch in the Netherlands. A security vulnerability exists in Kwik prior to version 0.10.1, which stems from the inclusion of a hash conflict vulnerability. A remote attacker could exploit...

DENX Software Engineering Das U-Boot 安全漏洞

DENX Software Engineering Das U-Boot is a Universal Bootloader from DENX Software Engineering, Germany. A security vulnerability exists in versions prior to DENX Software Engineering Das U-Boot 2025.01-rc1 that stems from stack exhaustion due to deep symbolic link nesting in squashfs...