OSV-2025-108 Use-of-uninitialized-value in decimate_dsd_run

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=395207096 Crash type: Use-of-uninitialized-value Crash state: decimatedsdrun WavpackUnpackSamples fuzzer.cc...

CVE-2024-3271

A command injection vulnerability exists in the run-llama/llamaindex repository, specifically within the safeeval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. This is achieved by...

CVE-2024-29848

An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execute arbitrary commands as SYSTEM...

CLSA-2025-1738696117 php: Fix of CVE-2024-8929

CVE-2024-8929: fix various heap buffer over-reads for mysqlnd - Modify spec and run-tests.php to fix extension loading during testing...

PT-2025-20625

Name of the Vulnerable Software and Affected Versions run-llama/llama index version latestv0.12.15 Description A Denial of Service DoS issue has been identified in the KnowledgeBaseWebReader class due to inadequate secure coding practices. Specifically, the lack of proper implementation of the ma...

CVE-2025-0848

A vulnerability was found in Tenda A18 up to 15.13.07.09. It has been rated as critical. This issue affects the function SetCmdlineRun of the file /goform/SetCmdlineRun of the component HTTP POST Request Handler. The manipulation of the argument wpapskcrypto5g leads to stack-based buffer overflow...

fs/ntfs3: Fix general protection fault in run_is_mapped_full

...

CVE-2025-24362

In some circumstances, debug artifacts uploaded by the CodeQL Action after a failed code scanning workflow run may contain the environment variables from the workflow run, including any secrets that were exposed as environment variables to the workflow. Users with read access to the repository...

CVE-2025-21562

Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft component: Run Control Management. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

CVE-2025-21563

Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft component: Run Control Management. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

CVE-2024-50954

The XINJE XL5E-16T and XD5E-24R-E programmable logic controllers V3.5.3b-V3.7.2a have a vulnerability in handling Modbus messages. When a TCP connection is established with the above series of controllers within a local area network LAN, sending a specific Modbus message to the controller can cau...

CVE-2024-50954

The XINJE XL5E-16T and XD5E-24R-E programmable logic controllers V3.5.3b-V3.7.2a have a vulnerability in handling Modbus messages. When a TCP connection is established with the above series of controllers within a local area network LAN, sending a specific Modbus message to the controller can cau...

WAVLINK AC3000 命令注入漏洞

WAVLINK AC3000 is a wireless router from China Ruiyin WAVLINK. A command injection vulnerability exists in the WAVLINK AC3000 M33A8.V5030.210505 version, which stems from the firewall.cgi iptablesWebsFilterRun function failing to correctly filter constructor command special characters, commands,...

CVE-2024-48875 btrfs: don't take dev_replace rwsem on task already holding it

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't take devreplace rwsem on task already holding it Running fstests btrfs/011 with MKFSOPTIONS="-O rst" to force the usage of the RAID stripe-tree, we get the following splat from lockdep: BTRFS info device sdd:...

CVE-2024-56635 net: avoid potential UAF in default_operstate()

In the Linux kernel, the following vulnerability has been resolved: net: avoid potential UAF in defaultoperstate syzbot reported an UAF in defaultoperstate 1 Issue is a race between device and netns dismantles. After calling rtnlunlock from netdevruntodo, we can not assume the netns of each devic...

PT-2024-17824 · Melmass +1 · Melmass +1

Name of the Vulnerable Software and Affected Versions: melMass comfy mtb versions up to 0.1.4 Description: A critical vulnerability was found in the Dependency Handler component, specifically in the run command function of the file comfy mtb/endpoint.py. This vulnerability leads to code injection...

MAL-2024-12111 Malicious code in cloudinary-ct-run-sub (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b8b17191416c445db03bfceae872f6642a1171a2300b65df0c546dd5a1fc19bc The OpenSSF Package Analysis project identified 'cloudinary-ct-run-sub' @ 1.1.0 npm as malicious. It is considered malicious because: - The...

Malicious code in cloudinary-ct-run-sub (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b8b17191416c445db03bfceae872f6642a1171a2300b65df0c546dd5a1fc19bc The OpenSSF Package Analysis project identified 'cloudinary-ct-run-sub' @ 1.1.0 npm as malicious. It is considered malicious because: - The...

MAL-2024-12022 Malicious code in pnpm-run (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d39da4628840938cc4d6581c772a1f0039a45ec515eb70d692ec5032b15ee087 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pnpm-run (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d39da4628840938cc4d6581c772a1f0039a45ec515eb70d692ec5032b15ee087 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...