Mastodon code issues and vulnerabilities

Mastodon is an open source social networking server based on ActivityPub by Mastodon Open Source. A code issue vulnerability exists in Mastodon versions prior to 4.5.4, prior to 4.4.11, prior to 4.3.17, and prior to 4.2.29, which stems from the lack of an IP address range restriction that could...

PT-2026-1848

Name of the Vulnerable Software and Affected Versions Plesk Obsidian versions 8.0.1 through 18.0.73 Description Plesk Obsidian versions 8.0.1 through 18.0.73 are susceptible to a Denial of Service DoS condition. The issue resides in the get password.php API endpoint, where a specifically crafted...

NiceGUI cross-site scripting vulnerability

NiceGUI is an easy-to-use, Python-based UI framework from NiceGUI Open Source. A cross-site scripting vulnerability exists in NiceGUI versions 2.22.0 through 3.4.1, which stems from an insecure implementation of the click event listener and could lead to cross-site scripting attacks...

CVE-2025-69264

pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 security feature "Dependency lifecycle scripts execution disabled by default". While pnpm v10 blocks postinstall scripts via the...

@aigelb/chatbot-widget (>=5.0.0, <=8.2.0), @evelan/jexity-widget (>=0.0.1, <=0.13.1) +14 more potentially affected by CVE-2026-22028 via preact (>=10.27.0, <=10.27.2)

preact NPM version =10.27.0, =5.0.0, =0.0.1, =0.2.0-canary.7cb2837, =1.2.1, =1.4.1-snapshot-20251113025641, =3.0.263, =0.1.17, =0.1.17, =0.2.22, =1.14.0, =0.0.111, =0.0.122 - extension 3.11.1-canary.254.c83f9e7 and more Source cves: CVE-2026-22028 Source advisory: OSV:GHSA-36HM-QXXP-PG3M...

CVE-2019-12472

An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks $wgBlockCIDRLimit by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6...

CVE-2025-1721

IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory...

CVE-2025-1031

Authorization Bypass Through User-Controlled Key vulnerability in Utarit Informatics Services Inc. SoliClub allows Functionality Misuse.This issue affects SoliClub: from 5.2.4 before 5.3.7...

CVE-2025-15474 AuntyFey Smart Combination Lock BLE Connection Flood DoS

AuntyFey Smart Combination Lock firmware versions as of 2025-12-24 contain a vulnerability that allows an unauthenticated attacker within Bluetooth Low Energy BLE range to cause a denial of service by repeatedly initiating BLE connections. Sustained connection attempts interrupt keypad...

EUVD-2025-206255

Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro Installer SFX on Windows allows Search Order Hijacking.This issue affects Quartus Prime Pro: from 24.1 through 24.3.1...

SUSE CVE-2025-69225

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request...

Altera Quartus Prime Pro security vulnerability

Altera Quartus Prime Pro is an FPGA design software from Altera Corporation, USA. A security vulnerability exists in Altera Quartus Prime Pro versions 24.1 through 25.1.1, which stems from the Windows installer's use of predictable filenames that could lead to an insecure temporary file...

CVE-2025-14596 Quartus Prime Pro Edition Installer Advisory

Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro Installer SFX on Windows allows Search Order Hijacking.This issue affects Quartus Prime Pro: from 24.1 through 24.3.1...

directus (>=11.13.0, <=11.13.4) potentially affected by CVE-2026-22032 via @directus/api (>=32.0.0, <=32.1.1)

@directus/api NPM version =32.0.0, =11.13.0, =11.13.4 Source cves: CVE-2026-22032 Source advisory: SNYK:JS-DIRECTUSAPI-14892568...

@ai-growth/n8n-nodes-wordpress (>=0.2.0, <=0.6.12), @antonytm/n8n-nodes-test (>=0.1.5, <=0.2.1) +77 more potentially affected by CVE-2026-21877 via n8n-workflow (>=1.0.0, <=1.118.1)

n8n-workflow NPM version =1.0.0, =0.2.0, =0.1.5, =0.0.17, =1.0.2, =1.0.1, =0.2.0, =0.19.0, =0.4.0, =0.11.0, =1.1.0, =1.1.0, =1.1.0, =1.0.1, =1.57.1 and more Source cves: CVE-2026-21877 Source advisory: SNYK:JS-N8NWORKFLOW-14894273...

CVE-2025-69225

A flaw was found in aiohttp, an asynchronous HTTP client/server framework. The parser logic allows non-ASCII decimal characters in the HTTP Range header. This could potentially enable a remote attacker to exploit a request smuggling vulnerability, leading to the bypass of security controls or...

SUSE CVE-2024-41260

A static initialization vector IV in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information email addresses when in possession of the audit events database...

DEBIAN-CVE-2025-69225

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request...

AZL-73500 CVE-2025-69225 affecting package python-aiohttp 3.6.2-3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request...

AZL-73523 CVE-2025-69225 affecting package python-aiohttp 3.6.2-3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request...