CVE-2025-8262 yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos

A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file src/resolvers/exotics/hosted-git-resolver.js. The manipulation leads to inefficient regular expression complexity. It is possible to launch...

CVE-2025-8262

A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file src/resolvers/exotics/hosted-git-resolver.js. The manipulation leads to inefficient regular expression complexity. It is possible to launch...

CVE-2025-8176

A flaw was found in libtiff. The gethistogram function in file/tiffmedian.c exhibits a use-after-free condition when processing a specially crafted file, allowing a local attacker to trigger memory corruption. This manipulation results in a use-after-free vulnerability, and can lead to a denial o...

PT-2025-31124 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: TeamCity versions prior to 2025.07 Description: A reflected cross-site scripting XSS issue existed on the agentpushPreset page. Recommendations: Update to TeamCity version 2025.07 or later...

PT-2025-31053 · Unknown +1 · Yarnpkg Yarn +1

Name of the Vulnerable Software and Affected Versions: yarnpkg Yarn versions up to 1.22.22 Description: A vulnerability exists in the explodeHostedGitFragment function within the src/resolvers/exotics/hosted-git-resolver.js file. This manipulation results in inefficient regular expression...

PT-2025-31121 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: TeamCity versions prior to 2025.07 Description: A path traversal issue existed in JetBrains TeamCity due to improper handling of plugin unpacking on Windows systems. This allowed for unauthorized access to files and directories...

PT-2025-31156 · Appliance · Appliance

Name of the Vulnerable Software and Affected Versions: affected versions not specified Description: An API endpoint intended for web application administrators is accessible to lower-level read-only users. This allows unauthorized access to appliance configuration import functionality, potentiall...

PT-2025-31096 · Beamsec · Beamsec Phishpro

Name of the Vulnerable Software and Affected Versions: Beamsec PhishPro versions prior to 7.5.4.2 Description: An incorrect use of privileged APIs allows for privilege abuse in Beamsec PhishPro. Recommendations: Update Beamsec PhishPro to version 7.5.4.2 or later...

PT-2025-31154 · Polkadot · Polkadot Frontier

Name of the Vulnerable Software and Affected Versions: Polkadot Frontier versions prior to 0822030 Description: Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. The implementation of CallableByContract incorrectly identified contract addresses running under...

PT-2025-31048

Name of the Vulnerable Software and Affected Versions ssrfcheck versions prior to 1.2.0 Description The package is vulnerable to Server-Side Request Forgery SSRF due to an incomplete denylist of IP address ranges. The package fails to classify the reserved IP address space 224.0.0.0/4 Multicast a...

PT-2025-31122 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: TeamCity versions prior to 2025.07 Description: Improper access control allowed the disclosure of build settings via snapshot dependencies. Recommendations: Update to version 2025.07 or later...

PT-2025-31058 · Yanyutao0402 · Chancms

Name of the Vulnerable Software and Affected Versions: yanyutao0402 ChanCMS versions through 3.1.2 Description: A critical vulnerability exists in yanyutao0402 ChanCMS. The getArticle function within the app/modules/cms/controller/collect.js file is susceptible to deserialization due to...

PT-2025-31047 · Unknown · Cool Mo Maigcal Number App

Name of the Vulnerable Software and Affected Versions: Cool Mo Maigcal Number App versions up to 1.0.3 Description: A problematic vulnerability has been identified in Cool Mo Maigcal Number App for Android. The issue affects an unknown functionality within the AndroidManifest.xml file of the...

PT-2025-31114 · Unknown · User Registry

Name of the Vulnerable Software and Affected Versions: Versions prior to 25.4.270.0 Description: A local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability ...

PT-2025-31123 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: TeamCity versions prior to 2025.07 Description: Improper access control allowed the disclosure of build settings via VCS configuration. Recommendations: Update to TeamCity version 2025.07 or later...

PT-2025-31127 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: TeamCity versions prior to 2025.07 Description: User credentials were stored in plain text in memory snapshots. Recommendations: Update to version 2025.07 or later...

PT-2025-31126 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2025.07 Description: A Cross-Site Request Forgery CSRF issue was identified in JetBrains TeamCity. The issue affects the GraphQL endpoint /api/graphql. Recommendations: Update JetBrains TeamCity to version...

Invision Community 4.7.20 - (calendar/view.php) SQL Injection

Exploit Title: Invision Community = 4.7.18. Proof of Concept https://karmainsecurity.com/pocs/CVE-2025-48932.php Solution Upgrade to v...

Improper Neutralization of Input Used for LLM Prompting

Overview @google/gemini-cli is a Gemini CLI Affected versions of this package are vulnerable to Improper Neutralization of Input Used for LLM Prompting due to an improper implementation of the getCommandRoot and isCommandAllowed functions. An attacker can inject malicious commands by leveraging...

CVE-2025-8226 yanyutao0402 ChanCMS find information disclosure

A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been classified as problematic. Affected is an unknown function of the file /sysApp/find. The manipulation of the argument accessKey/secretKey leads to information disclosure. It is possible to launch the attack remotely. The...