HAXiam 安全漏洞

HAXiam is a HAX The Web open source This is a wrapper for the HAXcms software. A security vulnerability exists in HAXiam version 11.0.4 and earlier, which stems from an improper response to a user data request and could lead to a user enumeration attack...

GHSA-JJWR-5CFH-7XWH DSpace is vulnerable to XML External Entity injection during archive imports

Impact Two related XXE injection possibilities have been discovered, impacting all versions of DSpace prior to 7.6.4, 8.2 and 9.1. 1. External entities are not disabled when parsing XML files during import of an archive in Simple Archive Format, either from command-line ./dspace import command or...

CVE-2024-47065

Meshtastic is an open source mesh networking solution. Prior to 2.5.1, traceroute responses from the remote node are not rate limited. Given that there are SNR measurements attributed to each received transmission, this is a guaranteed way to get a remote station to reliably and continuously...

CVE-2024-47065 Traceroute_APP responses are not rate-limited.

Meshtastic is an open source mesh networking solution. Prior to 2.5.1, traceroute responses from the remote node are not rate limited. Given that there are SNR measurements attributed to each received transmission, this is a guaranteed way to get a remote station to reliably and continuously...

CVE-2024-47065 Traceroute_APP responses are not rate-limited.

Meshtastic is an open source mesh networking solution. Prior to 2.5.1, traceroute responses from the remote node are not rate limited. Given that there are SNR measurements attributed to each received transmission, this is a guaranteed way to get a remote station to reliably and continuously...

CVE-2024-47065 Traceroute_APP responses are not rate-limited.

Meshtastic is an open source mesh networking solution. Prior to 2.5.1, traceroute responses from the remote node are not rate limited. Given that there are SNR measurements attributed to each received transmission, this is a guaranteed way to get a remote station to reliably and continuously...

CVE-2025-53862

A flaw was found in Ansible. Three API endpoints are accessible and return verbose, unauthenticated responses. This flaw allows a malicious user to access data that may contain important information...

CVE-2025-53862

A flaw was found in Ansible. Three API endpoints are accessible and return verbose, unauthenticated responses. This flaw allows a malicious user to access data that may contain important information...

CVE-2025-53862

CVE-2025-53862 affects Red Hat Ansible. The vulnerability arises from three API endpoints that expose verbose, unauthenticated responses, enabling access to potentially sensitive information. Severity is low (CVSS 3.1: 3.5, ADJACENT access, low privileges, no user interaction). Public references ...

OESA-2025-1778 nbdkit security update

NBD Network Block Device is a protocol for accessing Block Devices hard disks and disk-like things over a Network. nbdkit is a toolkit for creating NBD servers. The key features are: Multithreaded NBD server written in C with good performance. Minimal dependencies for the basic server. Liberal...

Systemd-resolved: unsigned name response in signed zone is not refused when dnssec=yes

...

PT-2025-29229 · Red Hat · Ansible

Name of the Vulnerable Software and Affected Versions: Ansible affected versions not specified Description: A flaw exists in Ansible that allows a malicious user to access data through three API endpoints that return verbose, unauthenticated responses. This may contain important information...

CVE-2025-6211

A vulnerability in the DocugamiReader class of the run-llama/llamaindex repository, up to version 0.12.28, involves the use of MD5 hashing to generate IDs for document chunks. This approach leads to hash collisions when structurally distinct chunks contain identical text, resulting in one chunk...

CVE-2025-6211 MD5 Hash Collision in run-llama/llama_index

A vulnerability in the DocugamiReader class of the run-llama/llamaindex repository, up to version 0.12.28, involves the use of MD5 hashing to generate IDs for document chunks. This approach leads to hash collisions when structurally distinct chunks contain identical text, resulting in one chunk...

The vulnerability of Websoft HCM’s automation software for HR processes lies in its inability to properly handle incoming requests, allowing attackers to disclose protected information.

The vulnerability of Websoft HCM’s automation software for HR processes is related to inconsistencies in the responses to incoming requests. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

Attacker'S Noise Can Manipulate Your Audio-Based LLM in the Real World

This paper investigates the real-world vulnerabilities of audio-based large language models ALLMs, such as Qwen2-Audio. We first demonstrate that an adversary can craft stealthy audio perturbations to manipulate ALLMs into exhibiting specific targeted behaviors, such as eliciting responses to...

Emergent Misalignment As Prompt Sensitivity: a Research Note

Betley et al. 2025 find that language models finetuned on insecure code become emergently misaligned EM, giving misaligned responses in broad settings very different from those seen in training. However, it remains unclear as to why emergent misalignment occurs. We evaluate insecure models across...

CVE-2025-48991

Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a vulnerability present in Tuleap Community Edition prior to version 16.8.99.1748845907 and Tuleap Enterprise Edition prior to versions 16.8-3 and 16.7-5 to trick victims into...

CVE-2025-48991

CVE-2025-48991 describes a cross-site request forgery vulnerability in Tuleap that could allow an attacker to trick victims into changing canned tracker responses. Affected versions: Tuleap Community Edition prior to 16.8.99.1748845907; Tuleap Enterprise Edition prior to 16.8-3 and prior to 16.7-...

CVE-2025-48991 Tuleap missing CSRF protection on tracker canned responses administration

Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a vulnerability present in Tuleap Community Edition prior to version 16.8.99.1748845907 and Tuleap Enterprise Edition prior to versions 16.8-3 and 16.7-5 to trick victims into...