CVE-2025-66605

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. Since there are input fields on this webpage with the autocomplete attribute enabled, the input content could be saved in the browser the user is using. The affected products and versions are as follows:...

CVE-2025-66605

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. Since there are input fields on this webpage with the autocomplete attribute enabled, the input content could be saved in the browser the user is using. The affected products and versions are as follows:...

Super-Linter command injection vulnerability

Super-Linter is a code checker developed by Super Linter. Versions 6.0.0 to 8.3.0 of Super-Linter have a command injection vulnerability, which stems from improper handling of specially crafted file names. This vulnerability may lead to command injection attacks...

Craft CMS SQL injection vulnerability

Craft CMS is an open-source content management system developed by Craft CMS. Versions 4.0.0-RC1 to 4.16.17, and 5.0.0-RC1 to 5.8.21 of Craft CMS have SQL injection vulnerabilities. These vulnerabilities stem from improper cleaning of the criteriaorderBy parameter input, which may lead to SQL...

PT-2026-7060

Name of the Vulnerable Software and Affected Versions FAST/TOOLS versions R9.01 through R10.04 Description The software is susceptible to Cross-Site Request Forgery CSRF. An attacker could compromise a user’s account by having the user access a crafted link. Recommendations Update to a version...

Yokogawa FAST/TOOLS security vulnerabilities

Yokogawa FAST/TOOLS is a real-time operation management and visualization software developed by Yokogawa Electric Corporation. There are security vulnerabilities in the Yokogawa FAST/TOOLS R9.01 version up to R10.04. These vulnerabilities stem from the support for older versions of SSL/TLS, which...

Cube security vulnerabilities

Cube is a semantic layer for building data applications developed by Cube OpenSource. There were security vulnerabilities in versions of Cube between 0.27.19 and 1.5.13, as well as in versions before 1.4.2 and 1.0.14. These vulnerabilities stemmed from the possibility of privilege escalation when...

PT-2026-7052

Name of the Vulnerable Software and Affected Versions FAST/TOOLS versions R9.01 through R10.04 Description A flaw exists in FAST/TOOLS by Yokogawa Electric Corporation where the library version can be revealed on a web page. This disclosed information may be leveraged by attackers to facilitate...

PT-2026-7138

Craft is a platform for creating digital experiences. From 5.0.0-RC1 to 5.8.21, Craft has a stored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list. This vulnerability is fixed in 5.8.22...

Linux Btrfs Heap Buffer Overflow DoS

The vulnerability of the cowfilerange function in the fs/btrfs/inode.c module of the Linux file system support module is related to improper cleaning or release of resources. Exploiting this vulnerability can allow an attacker to cause service failures...

CVE-2026-25793

Nebula is a scalable overlay networking tool. In versions from 1.7.0 to 1.10.2, when using P256 certificates which is not the default configuration, it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of th...

CVE-2026-25793 Nebula Has Possible Blocklist Bypass via ECDSA Signature Malleability

Nebula is a scalable overlay networking tool. In versions from 1.7.0 to 1.10.2, when using P256 certificates which is not the default configuration, it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of th...

CVE-2026-25793

Nebula is a scalable overlay networking tool. In versions from 1.7.0 to 1.10.2, when using P256 certificates which is not the default configuration, it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of th...

CVE-2026-25628

Qdrant is a vector similarity search engine and vector database. From 1.9.3 to before 1.16.0, it is possible to append to arbitrary files via /logger endpoint using an attacker-controlled ondisk.logfile path. Minimal privileges are required read-only access. This vulnerability is fixed in 1.16.0...

@kimuson/claude-code-viewer (>=0.4.2-beta.2, <=0.5.9), @machina.at/cli (>=19.24.1, <=19.43.0) +20 more potentially affected by CVE-2026-25725 via @anthropic-ai/claude-code (>=2.0.0, <=2.0.76)

@anthropic-ai/claude-code NPM version =2.0.0, =0.4.2-beta.2, =19.24.1, =1.0.0-broken, =0.0.1-rc.1, =0.12.0, =0.5.2, =0.12.1, =0.0.0, =0.1.2, =1.9.1, =1.9.1, =1.9.6 and more Source cves: CVE-2026-25725 Source advisory: OSV:GHSA-FF64-7W26-62RF...

@kimuson/claude-code-viewer (>=0.4.2-beta.2, <=0.5.9), @machina.at/cli (>=19.24.1, <=19.43.0) +20 more potentially affected by CVE-2026-25724 via @anthropic-ai/claude-code (>=2.0.0, <=2.0.76)

@anthropic-ai/claude-code NPM version =2.0.0, =0.4.2-beta.2, =19.24.1, =1.0.0-broken, =0.0.1-rc.1, =0.12.0, =0.5.2, =0.12.1, =0.0.0, =0.1.2, =1.9.1, =1.9.1, =1.9.6 and more Source cves: CVE-2026-25724 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-15248353...

[actix-files] Panic triggered by empty Range header in GET request for static file

Summary A GET request for a static file served by actix-files with an empty Range header triggers a panic. With panic = "abort", a remote user may crash the process on-demand. Details actix-files assumes that HttpRange::parse, when Ok, always returns a vector with at least one element. When parse...

GHSA-GCQF-3G44-VC9P [actix-files] Panic triggered by empty Range header in GET request for static file

Summary A GET request for a static file served by actix-files with an empty Range header triggers a panic. With panic = "abort", a remote user may crash the process on-demand. Details actix-files assumes that HttpRange::parse, when Ok, always returns a vector with at least one element. When parse...

CVE-2026-24050

Zulip (open-source team collaboration tool) is affected by a stored XSS issue in administrative actions on user profiles in group names and channel names, across Zulip server versions 5.0 up to, but not including, 11.5. The vulnerability requires user interaction with the problematic object and i...

CVE-2026-24851

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.5 to v1.11.2 openfga-0.2.22= Helm chart = openfga-0.2.51, v.1.8.5 = docker = v.1.11.2 are vulnerable to improper policy enforcement when certain Check call...