CVE-2025-54891

The CVE-2025-54891 issue is an XSS vulnerability in Centreon Infra Monitoring (ACL Resource access configuration modules) caused by Improper Neutralization of Input During Web Page Generation. Affected versions are Centreon Infra Monitoring 23.10.0–23.10.28, 24.04.0–24.04.18, and 24.10.0–24.10.13...

UBUNTU-CVE-2025-11712

A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This could have contributed to an XSS on a site that unsafely serves files without a content-type header. This vulnerabilit...

Mozilla -- XSS in sites without content-type header

[email protected] reports: A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This could have contributed to an XSS on a site that unsafely serves files without a...

Fortinet FortiAnalyzer 竞争条件问题漏洞

FortiAnalyzer is Fortinet's centralized security log management and analysis platform. FortiAnalyzer suffers from a competitive condition vulnerability that stems from an improper synchronization mechanism for shared resources. An attacker can exploit this vulnerability to bypass the FortiCloud...

CVE-2025-31969

HCL Unica Platform is impacted by misconfigured Content Security Policy CSP. These can result in malicious resources getting loaded and browsers may come across certain types of attacks, such as cross-site scripting and clickjacking...

CVE-2025-31969

HCL Unica Platform is impacted by misconfigured Content Security Policy CSP. These can result in malicious resources getting loaded and browsers may come across certain types of attacks, such as cross-site scripting and clickjacking...

PT-2025-41712

Name of the Vulnerable Software and Affected Versions HCL Unica Platform affected versions not specified Description The HCL Unica Platform is susceptible to issues stemming from a misconfigured Content Security Policy CSP. This misconfiguration can allow malicious resources to load, potentially...

bluetooth/l2cap: sync sock recv cb and release

...

PT-2025-41684

Name of the Vulnerable Software and Affected Versions WP Scraper plugin for WordPress versions prior to 5.8.2 Description The WP Scraper plugin for WordPress is susceptible to Server-Side Request Forgery SSRF in versions up to and including 5.8.1. This flaw resides within the wp scraper extract...

The vulnerability of Websoft HCM’s automation software for HR processes allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of Websoft HCM’s automation software for HR processes is related to the disclosure of information in debugging messages. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Juniper Networks Junos OS SRX 安全漏洞

Juniper Networks Junos OS SRX is a Juniper Networks USA network operating system dedicated to the company's hardware devices. The operating system provides a secure programming interface and the Junos SDK. A security vulnerability exists in Juniper Networks Junos OS SRX version 24.4 up to and...

The vulnerability of the upsert operation in the MongoDB database management system allows a hacker to cause a service failure.

The vulnerability of the upsert operation in the MongoDB database management system is related to operations involving resources after their expiration. Exploiting this vulnerability can allow an attacker to cause service failures...

CVE-2025-11362

Versions of the package pdfmake before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input that triggers this condition...

ROS-20251008-08

The vulnerability of the libexpat XML file parsing library is related to the fact that the application does not control the internal resource consumption properly. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

Linux Distros Unpatched Vulnerability : CVE-2023-53532

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix deinitialization of firmware resources Currently, in...

Linux Distros Unpatched Vulnerability : CVE-2023-53567

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - spi: qup: Don't skip cleanup in remove's error path Returning early in a platform driver's remove callback is wrong. In this case the dma resources are not...

The vulnerability of the cross-platform Xen kernel supervisor in Linux operating systems, related to synchronization errors when using shared resources, allows a perpetrator to compromise the vulnerable system.

The vulnerability of the cross-platform hypervisor Xen in Linux operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability allows a remote attacker to compromise the vulnerable system...

SUSE CVE-2022-50544

In the Linux kernel, the following vulnerability has been resolved: usb: host: xhci: Fix potential memory leak in xhciallocstreaminfo xhciallocstreaminfo allocates stream context array for streaminfo -streamctxarray with xhciallocstreamctx. When some error occurs, streaminfo-streamctxarray is not...

Server-side Request Forgery (SSRF)

Overview llamafactory is an Easy-to-use LLM fine-tuning framework Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the processrequest function, which processes incoming content URLs without proper validation or sanitization. An attacker can access internal...

LLaMA Factory's Chat API Contains Critical SSRF and LFI Vulnerabilities

Summary A Server-Side Request Forgery SSRF vulnerability in the chat API allows any authenticated user to force the server to make arbitrary HTTP requests to internal and external networks. This can lead to the exposure of sensitive internal services, reconnaissance of the internal network, or...