CVE-2025-63714

Cross-Site Scripting XSS vulnerability in SourceCodester User Account Generator 1.0 allows remote attackers to execute arbitrary JavaScript code in the context of the user's browser session via crafted input in the Username Prefix field. The vulnerability exists due to improper sanitization of...

CVE-2025-63714

Cross-Site Scripting XSS vulnerability in SourceCodester User Account Generator 1.0 allows remote attackers to execute arbitrary JavaScript code in the context of the user's browser session via crafted input in the Username Prefix field. The vulnerability exists due to improper sanitization of...

CVE-2025-63713

Cross-Site Scripting XSS vulnerability in SourceCodester "MatchMaster" 1.0 allows remote attackers to inject arbitrary web script or HTML via crafted input in the custom test creation feature. The vulnerability exists because the application fails to properly sanitize user-supplied input in test...

CVE-2025-63714

SourceCodester User Account Generator 1.0 contains a Cross‑Site Scripting (XSS) vulnerability in the Username Prefix field. The root cause is improper sanitization of user input when rendering generated account data to the DOM, allowing persistent injection of malicious HTML elements that execute...

Fedora 43 : webkitgtk (2025-452a101260)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-452a101260 advisory. Update to WebKitGTK 2.50.1: Improve text rendering performance. Fix audio playback broken on instagram. Fix rendering of layers with fractional transforms. F...

[SECURITY] Fedora 42 Update: qt5-qtsvg-5.15.18-1.fc42

Scalable Vector Graphics SVG is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices...

[SECURITY] Fedora 42 Update: qt5-qt3d-5.15.18-1.fc42

Qt 3D provides functionality for near-realtime simulation systems with support for 2D and 3D rendering in both Qt C++ and Qt Quick applications...

The vulnerability of the aca_banks_release() function in the drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c driver module allows a hacker to trigger a service failure in AMD GPU cores supporting Direct Rendering Infrastructure (DRI) in the Linux operating system.

The vulnerability of the acabanksrelease function in the drivers/gpu/drm/amd/amdgpu/amdgpuaca.c driver module relates to the pointer manipulation in AMD GPU kernel support for Linux operating systems. Exploiting this vulnerability can allow an attacker to cause a service failure...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990311)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990311 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/komeda: check for error-valued pointer komedapipelinegetstate may return an error-valued...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990198)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990198 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dispnv04: fix null pointer dereference in nv17tvgetldmodes In nv17tvgetldmodes, the...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988974)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988974 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp5: Return error code in mdp5mixerrelease when deadlock is detected There is a...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989423)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989423 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference In tpg110getmodes, the return...

Cross-site Scripting (XSS)

@lobehub/cha is vulnerable to a Cross-Site Scripting XSS. The vulnerability is due to unsafe SVG rendering due to SVGRenderer using dangerouslySetInnerHTML for image/svg+xml lobeArtifact content. An attacker can inject malicious SVGs via chat messages...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: drm/msm: Another leak in the submit error path has been fixed. putunusedfd does not free the allocated file if we have already performed fdinstall. Therefore, we also need to free the syncfile. Patchwork:...

EUVD-2025-37401

ELOG allows an authenticated user to upload arbitrary HTML files. The HTML content is executed in the context of other users when they open the file. Because ELOG includes usernames and password hashes in certain HTTP requests, an attacker can obtain the target's credentials and replay them or...

CVE-2025-62618 ELOG file upload stored XSS

ELOG allows an authenticated user to upload arbitrary HTML files. The HTML content is executed in the context of other users when they open the file. Because ELOG includes usernames and password hashes in certain HTTP requests, an attacker can obtain the target's credentials and replay them or...

[SECURITY] [DLA 4356-1] ublock-origin security update

Debian LTS Advisory DLA-4356-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany October 31, 2025 https://wiki.debian.org/LTS Package : ublock-origin Version : 1.67.0+dfsg-1deb11u1 Debian Bug : 1108878 Ublock-origin is a lightweight and efficient ads, malware and...

EUVD-2022-55675

Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting XSS in the update checking feature. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...

CVE-2020-36861 Nagios XI < 5.7.5 Core Config Manager (CCM) XSS via Overlay Rendering and Notification/Check Period Pages

The Core Config Manager CCM in Nagios XI versions prior to CCM 3.0.8 / Nagios XI 5.7.5 contains multiple cross-site scripting XSS vulnerabilities in the overlay UI elements and the Notification/Check Period pages. Insufficient validation or escaping of user-supplied input may allow an attacker to...

GO-2025-4065 Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution in github.com/mattermost/mattermost-server

Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution in github.com/mattermost/mattermost-server...