CVE-2025-27380

HTML injection in Project Release in Altium Enterprise Server AES 7.0.3 on all platforms allows an authenticated attacker to execute arbitrary JavaScript in the victim’s browser via crafted HTML content...

PT-2026-4283

Name of the Vulnerable Software and Affected Versions Project File Management System affected versions not specified Description An attacker with access to the project file could use exposed credentials to impersonate users, escalate privileges, or gain unauthorized access to systems and services...

PT-2026-4100

Name of the Vulnerable Software and Affected Versions cjjparadoxmax Synergy Project Manager versions through 1.5 Description The Synergy Project Manager software contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-site Scripting XSS. This...

PT-2026-4092

Name of the Vulnerable Software and Affected Versions LazyTasks versions through 1.4.01 Description A privilege assignment issue exists in LazyTasks lazytasks-project-task-management, potentially allowing privilege escalation. Recommendations Update LazyTasks to a version later than 1.4.01...

Altium Enterprise Server security vulnerabilities

Altium Enterprise Server is a localization data management server developed by Altium Corporation in the United States. Version 7.0.3 of Altium Enterprise Server contains a security vulnerability. This vulnerability stems from HTML injection in Project Release, which may allow arbitrary JavaScrip...

PT-2026-3896

Name of the Vulnerable Software and Affected Versions Altium Enterprise Server AES version 7.0.3 Description An authenticated attacker can execute arbitrary JavaScript in a victim’s browser through crafted HTML content within the Project Release feature. This impacts all platforms. Recommendation...

WordPress plugin Synergy Project Manager has a cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

AutomationDirect CLICK Programmable Logic Controller security vulnerability

The AutomationDirect CLICK Programmable Logic Controller is a programmable logic controller developed by the AutomationDirect company in the United States. The AutomationDirect CLICK Programmable Logic Controller has a security vulnerability. This vulnerability stems from the exposure of...

langfuse Access Control Vulnerability

Langfuse is an open-source large language model engineering platform developed by Langfuse. Versions of Langfuse 3.146.0 and earlier contained a access control vulnerability. This vulnerability stemmed from the /api/public/slack/install endpoint using ProjectId provided by unauthenticated or...

PT-2026-3911

Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the /api/public/slack/install endpoint initiates Slack OAuth using a projectId provided by the client without authentication or authorization. The projectId is preserved throughout the OAuth flow,...

kernel-exploit-dirtycow-project

...

CVE-2026-23516

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.2.0 through 2.54.0, an attacker is able to execute arbitrary JavaScript in a victim user's CVAT UI session, provided that they are able to create a maliciously crafted label in a CVAT task or...

CVE-2026-21852

Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed malicious repositories to exfiltrate data including Anthropic API keys before users confirmed trust. An attacker-controlled repository could include a settings file that sets...

[SECURITY] Fedora 42 Update: freerdp-3.20.2-1.fc42

The xfreerdp & wlfreerdp Remote Desktop Protocol RDP clients from the FreeR DP project. xfreerdp & wlfreerdp can connect to RDP servers such as Microsoft Windows machines, xrdp and VirtualBox...

Insufficiently Protected Credentials

Overview @anthropic-ai/claude-code is an Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you. Affected versions of this package are vulnerable to Insufficiently Protected...

Everest-core security vulnerabilities

Everest-core is a major component of the open-source electric vehicle charging software stack developed by EVerest. Versions of everest-core prior to 2025.10.0 contained security vulnerabilities. These vulnerabilities allowed attackers to exhaust the operating system’s memory by establishing an...

The vulnerability of the clear_decompress() function in the RDP client FreeRDP allows a hacker to execute arbitrary code and trigger a service failure.

The vulnerability of the cleardecompress function in the RDP client FreeRDP is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code and cause service failures...

CVE-2026-22218

Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom Element with a user-controlled path value, causing the server to copy the referenced file into the attacker’s session. The resulting element...

GCVE-1-2026-0007

creationtimestamp| type| source ---|---|--- 2026-01-20 21:00:27+00:00| seen| https://bsky.app/profile/adulau.infosec.exchange.ap.brid.gy/post/3mcv2ed5ci5s2 2026-01-20 21:09:51+00:00| seen| https://infosec.exchange/@adulau/115929431973189919 2026-01-20 21:12:45+00:00| seen|...

Chainlit contain a server-side request forgery (SSRF) vulnerability

Chainlit versions prior to 2.9.4 contain a server-side request forgery SSRF vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled url value in an Element, which is fetched by the SQLAlchemy...