35592 matches found
EUVD-2025-206046
Malicious code in requeses PyPI...
WordPress ProfileGrid plugin <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management vulnerability
Missing Authorinzation to Authenticated Subscriber+ Join Group Requests Management vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin ProfileGrid versions = 5.9.4.4...
The vulnerability of the Cisco Catalyst Center (formerly Cisco DNA Center) network infrastructure management system, related to access control errors, allows a intruder to gain unauthorized access to protected information or enhance their privileges.
The vulnerability of the Cisco Catalyst Center formerly Cisco DNA Center network infrastructure management system is related to access control errors. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information or increase their privileges by...
EulerOS Virtualization 2.13.1 : python-pip (EulerOS-SA-2025-2630)
According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers...
Understanding Security Risks of AI Agents' Dependency Updates
Package dependencies are a critical control point in modern software supply chains. Dependency changes can substantially alter a project's security posture. As AI coding agents increasingly modify software via pull requests, it is unclear whether their dependency decisions introduce distinct...
SUSE-SU-2026:20035-1 Security update for podman
This update for podman fixes the following issues: - CVE-2025-47914: lack of message size validation when SSH Agent server is processing new identity requests can lead to out-of-bounds read and an application panic bsc1253993. - CVE-2025-47913: receiving an SSHAGENTSUCCESS reply when the SSH clie...
CVE-2025-69206
Hemmelig is a messing app with with client-side encryption and self-destructing messages. Prior to version 7.3.3, a Server-Side Request Forgery SSRF filter bypass vulnerability exists in the webhook URL validation of the Secret Requests feature. The application attempts to block internal/private ...
UBUNTU-CVE-2023-54269
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: double free xprtctxt while still in use When an RPC request is deferred, the rqxprtctxt pointer is moved out of the svcrqst into the svcdeferredreq. When the deferred request is revisited, the pointer is copied into the n...
CVE-2023-54326
In the Linux kernel, the following vulnerability has been resolved: misc: pciendpointtest: Free IRQs before removing the device In pciendpointtestremove, freeing the IRQs after removing the device creates a small race window for IRQs to be received with the test device memory already released,...
CVE-2023-54326 misc: pci_endpoint_test: Free IRQs before removing the device
In the Linux kernel, the following vulnerability has been resolved: misc: pciendpointtest: Free IRQs before removing the device In pciendpointtestremove, freeing the IRQs after removing the device creates a small race window for IRQs to be received with the test device memory already released,...
CVE-2023-54269 SUNRPC: double free xprt_ctxt while still in use
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: double free xprtctxt while still in use When an RPC request is deferred, the rqxprtctxt pointer is moved out of the svcrqst into the svcdeferredreq. When the deferred request is revisited, the pointer is copied into the n...
OESA-2025-2889 python-requests security update
Requests is an HTTP library, written in Python, as an alternative to Python's builtin urllib2 which requires work even method overrides to perform basic tasks. Features of Requests: - GET, HEAD, POST, PUT, DELETE Requests: + HTTP Header Request Attachment. + Data/Params Request Attachment. +...
OESA-2025-2888 python-requests security update
Requests is an HTTP library, written in Python, as an alternative to Python's builtin urllib2 which requires work even method overrides to perform basic tasks. Features of Requests: - GET, HEAD, POST, PUT, DELETE Requests: + HTTP Header Request Attachment. + Data/Params Request Attachment. +...
CVE-2025-69217
A flaw was found in coturn. A remote attacker can exploit a predictable random number generator used for nonces and port randomization. By sending a series of unauthenticated requests, an attacker can reconstruct the random number generator's state, allowing them to predict future nonces and port...
PT-2025-53832
Name of the Vulnerable Software and Affected Versions coturn versions 4.6.2r5 through 4.7.0-r4 Description coturn, a free open source implementation of TURN and STUN Server, contains a flaw related to its random number generator. Specifically, the random number generator for nonces and port...
PT-2025-53936
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.0.0-rc1-205202-gf26f8f761e83 218 Description A flaw exists in the SCSI subsystem of the Linux kernel, specifically within the pm8001 driver. The issue involves incorrect handling of the running req counter when...
PT-2025-54243
Name of the Vulnerable Software and Affected Versions SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and earlier Description The software contains a conditional command injection issue. Local authenticated users can create malicious files in the /tmp directory. Unauthenticated attackers can execute...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992532)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992532 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Handle EBUSY correctly As it is seqiv only handles the special return value of...
hemmelig allows SSRF Filter bypass via Secret Request functionality
Summary A Server-Side Request Forgery SSRF filter bypass vulnerability exists in the webhook URL validation of the Secret Requests feature. The application attempts to block internal/private IP addresses but can be bypassed using DNS rebinding e.g., localtest.me which resolves to 127.0.0.1 or ope...