PT-2025-36624

Summary A query depth restriction using the max-depth property can be bypassed if ignoreIntrospection is enabled which is the default configuration by naming your query/fragment schema. Details At the start of the countDepth function, we have the following check for the ignoreIntrospection option...

CVE-2025-52085

An SQL injection vulnerability in Yoosee application v6.32.4 allows authenticated users to inject arbitrary SQL queries via a request to a backend API endpoint. Successful exploitation enables extraction of sensitive database information, including but not limited to, the database server banner a...

Malicious code in schema-author (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d20adbaf902fa0024093fa6d9d1b21fe5c6f50e1fd5f11e13549e4cfe38e6de4 The OpenSSF Package Analysis project identified 'schema-author' @...

MAL-2025-41329 Malicious code in schema-author (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d20adbaf902fa0024093fa6d9d1b21fe5c6f50e1fd5f11e13549e4cfe38e6de4 The OpenSSF Package Analysis project identified 'schema-author' @...

Malicious code in action-schema-compiler (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-41360 Malicious code in action-schema-compiler (npm)

The package communicates with a domain associated with malicious activity...

CVE-2025-52085

An SQL injection vulnerability in Yoosee application v6.32.4 allows authenticated users to inject arbitrary SQL queries via a request to a backend API endpoint. Successful exploitation enables extraction of sensitive database information, including but not limited to, the database server banner a...

PT-2025-34475 · Yoosee · Yoosee

Name of the Vulnerable Software and Affected Versions: Yoosee version 6.32.4 Description: An SQL injection flaw exists in the Yoosee application that allows authenticated users to inject arbitrary SQL queries through a request to a backend API endpoint. Successful exploitation can lead to the...

CVE-2025-52085

The Yoosee smart home mobile application, version v6.32.4 , contains an SQL injection vulnerability (CWE-89). This flaw allows authenticated users to inject arbitrary SQL queries via a request to a backend API endpoint . Successful exploitation enables the extraction of sensitive database informa...

Linux Distros Unpatched Vulnerability : CVE-2020-2694

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Information Schema. Supported versions that are affected are 8.0.18 and prior...

CLSA-2025-1755708467 libxml2: Fix of 2 CVEs

CVE-2025-24928: fix stack-based buffer overflow in xmlSnprintfElements in valid.c - CVE-2024-56171: fix use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c...

Apache Superset Information Disclosure Vulnerability (CNVD-2025-19102)

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from an information disclosure vulnerability that stems from the /chart/data endpoint response containing underlying query information, which can be exploited by an attack...

Linux Distros Unpatched Vulnerability : CVE-2017-10283

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Performance Schema. Supported versions that are affected are 5.6.37 and earlie...

Linux Distros Unpatched Vulnerability : CVE-2025-27407

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21,...

Linux Distros Unpatched Vulnerability : CVE-2018-2590

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Performance Schema. Supported versions that are affected are 5.6.38 and prior...

WSDL Import Success

WSDL schema file was successfully imported and can be used during the scan. No source data...

WSDL Import Failed

WSDL schema file could not be imported and cannot be used during the scan. No source data...

Linux Distros Unpatched Vulnerability : CVE-2022-1552

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The...

GO-2025-3887 Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion in helm.sh/helm

Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion in helm.sh/helm...

BIT-SUPERSET-2025-55673 Apache Superset: Metadata exposure in embedded charts

When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. Thi...