83187 matches found
SGWBox N3 命令注入漏洞
SGWBox N3 is a network storage device from China's Pickup Dock SGWBox. A command injection vulnerability exists in SGWBox N3 version 2.0.25, which stems from incorrect manipulation of the parameter params in the file /usr/sbin/httpeshellserver, which could lead to command injection...
CVE-2025-36746
SolarEdge monitoring platform contains a Cross‑Site Scripting XSS flaw that allows an authenticated user to inject payloads into report names, which may execute in a victim’s browser during a deletion attempt...
CVE-2025-14606 tiny-rdm Tiny RDM Pickle Decoding pickle_convert.go pickle.loads deserialization
A security vulnerability has been detected in tiny-rdm Tiny RDM up to 1.2.5. Affected by this vulnerability is the function pickle.loads of the file pickleconvert.go of the component Pickle Decoding. The manipulation leads to deserialization. The attack can be initiated remotely. A high degree of...
EUVD-2025-203108
A vulnerability was detected in ggml-org whisper.cpp up to 1.8.2. Affected is the function readaudiodata of the file /whisper.cpp/examples/common-whisper.cpp. The manipulation results in use after free. The attack requires a local approach. The exploit is now public and may be used. The project w...
EUVD-2025-203169
An out-of-bounds write vulnerability exists in the Grassroots DICOM library GDCM. The issue is triggered during parsing of a malformed DICOM file containing encapsulated PixelData fragments compressed image data stored as multiple fragments. This vulnerability leads to a segmentation fault caused...
EUVD-2025-203087
SolarEdge monitoring platform contains a Cross‑Site Scripting XSS flaw that allows an authenticated user to inject payloads into report names, which may execute in a victim’s browser during a deletion attempt...
CVE-2025-36746
SolarEdge monitoring platform contains a Cross‑Site Scripting XSS flaw that allows an authenticated user to inject payloads into report names, which may execute in a victim’s browser during a deletion attempt...
CVE-2025-36746 SolarEdge Monitoring Platform contains a XSS upon report deletion
SolarEdge monitoring platform contains a Cross‑Site Scripting XSS flaw that allows an authenticated user to inject payloads into report names, which may execute in a victim’s browser during a deletion attempt...
CVE-2025-36746
SolarEdge Monitoring Platform contains a Cross‑Site Scripting (XSS) flaw that allows an authenticated user to inject payloads into report names, which may execute in a victim’s browser during a deletion attempt. The affected product is the SolarEdge Monitoring Platform; the vulnerability is trigg...
CVE-2025-36746 SolarEdge Monitoring Platform contains a XSS upon report deletion
SolarEdge monitoring platform contains a Cross‑Site Scripting XSS flaw that allows an authenticated user to inject payloads into report names, which may execute in a victim’s browser during a deletion attempt...
CVE-2025-13993
creationtimestamp| type| source ---|---|--- 2025-12-12 10:02:36+00:00| seen| https://gist.github.com/Darkcrai86/49c7536212a78bec751eb71b2d1df7f1 2025-12-12 11:38:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7ryt6hmgj2r...
Malicious code in sdbao-content-report (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 352174ed8ad21b72357fc69c51e395ee7b1ceb75b55603d205bdc8280dfc00b1 The package sdbao-content-report was found to contain malicious code. Source: ghsa-malware...
EUVD-2025-203043
Malicious code in sdbao-content-report npm...
MAL-2025-192564 Malicious code in sdbao-content-report (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 352174ed8ad21b72357fc69c51e395ee7b1ceb75b55603d205bdc8280dfc00b1 The package sdbao-content-report was found to contain malicious code. Source: ghsa-malware...
Malicious Package
Overview sdbao-content-report is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
PT-2025-51038
Name of the Vulnerable Software and Affected Versions Apple products affected versions not specified Description A permissions issue was identified and addressed through the implementation of additional restrictions. Recommendations At the moment, there is no information about a newer version tha...
PT-2025-50937
SolarEdge monitoring platform contains a Cross‑Site Scripting XSS flaw that allows an authenticated user to inject payloads into report names, which may execute in a victim’s browser during a deletion attempt...
EUVD-2025-202924
Next Server Actions Source Code Exposure...
Arbitrary file write via tar traversal
Summary A crafted tar.gz passed to MLflow pyfunc extraction is unpacked with tarfile.extractall without path validation. Archive entries containing .. or absolute paths can escape the destination directory and write arbitrary files on the host. This is reachable when users supply prebuiltenvuri o...