CVE-2025-34307: Improper Neutralization of Input During Web Page Generation

IPFire versions prior to 2.29 Core Update 198 contain a stored cross-site scripting XSS vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the pienumber parameter when updating the firewall country search defaults. When a user updates the default value...

ROS-20251028-11

A vulnerability in the NVIDIA Container Toolkit container creation and launch software and the NVIDIA GPU Operator resource management software is associated with synchronization errors. NVIDIA GPU Operator resource management software is associated with synchronization errors when using a shared...

TencentOS Server 4: netavark (TSSA-2025:0782)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0782 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2025-10939: Uncontrolled Search Path Element

A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to...

Amazon Linux 2023 : (ALAS2023-2025-1247)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1247 advisory. gi-docgen does not encode search terms before inserting them into HTML, allowing XSS via a crafted URL. Description obtained from: https://gitlab.gnome.org/GNOME/gi-docgen/-/issues/228 CVE-2025-11687...

AntiDupl Postback Link Vulnerability

AntiDupl is a program by the individual developer Ihar Yermalayeu that searches for similar and defective images on disk. AntiDupl 2.3.12 and earlier versions suffer from a backlink vulnerability that stems from a link-following issue in the file AntiDupl.NET.WinForms.exe of the component Delete...

EUVD-2025-36219

Reflected Cross Site Scripting vulnerability in Rubikon Banking Solution 4.0.3 in the "Search For Customers Information" endpoints...

CVE-2025-60983

Reflected Cross Site Scripting vulnerability in Rubikon Banking Solution 4.0.3 in the "Search For Customers Information" endpoints...

EUVD-2025-36189

A weakness has been identified in VeePN up to 1.6.2. This affects an unknown function of the file C:\Program Files x86\VeePN\avservice\avservice.exe of the component AVService. This manipulation causes unquoted search path. The attack requires local access. A high degree of complexity is needed f...

CVE-2025-12286

A weakness has been identified in VeePN up to 1.6.2. This affects an unknown function of the file C:\Program Files x86\VeePN\avservice\avservice.exe of the component AVService. This manipulation causes unquoted search path. The attack requires local access. A high degree of complexity is needed f...

CVE-2025-12286 VeePN AVService avservice.exe unquoted search path

A weakness has been identified in VeePN up to 1.6.2. This affects an unknown function of the file C:\Program Files x86\VeePN\avservice\avservice.exe of the component AVService. This manipulation causes unquoted search path. The attack requires local access. A high degree of complexity is needed f...

CVE-2025-12286

CVE-2025-12286 affects VeePN up to version 1.6.2, specifically the AVService component (C:\Program Files (x86)\VeePN\avservice\avservice.exe). The root cause is an unquoted search path in AVService, enabling a local attacker to exploit the condition with high complexity. Descriptions consistently...

CVE-2025-12286 VeePN AVService avservice.exe unquoted search path

A weakness has been identified in VeePN up to 1.6.2. This affects an unknown function of the file C:\Program Files x86\VeePN\avservice\avservice.exe of the component AVService. This manipulation causes unquoted search path. The attack requires local access. A high degree of complexity is needed f...

EUVD-2025-36191

Docker Desktop Installer.exe is vulnerable to DLL hijacking due to insecure DLL search order. The installer searches for required DLLs in the user's Downloads folder before checking system directories, allowing local privilege escalation through malicious DLL placement.This issue affects Docker...

CVE-2025-9164

Docker Desktop for Windows is affected by CVE-2025-9164 due to DLL hijacking in Docker Desktop Installer.exe caused by insecure DLL search order. The vulnerable component is the Docker Desktop Installer.exe, which searches the user’s Downloads folder for required DLLs before checking system direc...

EUVD-2025-36161

A flaw has been found in abhicodebox ModernShop 20250922. This issue affects some unknown processing of the file /search. Executing manipulation of the argument q can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used...

CVE-2025-12267

A flaw has been found in abhicodebox ModernShop 20250922. This issue affects some unknown processing of the file /search. Executing manipulation of the argument q can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used...

CVE-2025-12267

The CVE-2025-12267 affects abhicodebox ModernShop (v20250922). A flaw in the /search processing allows manipulation of the q parameter to trigger cross-site scripting. The issue can be exploited remotely and an exploit/public PoC exists. Multiple sources describe the vulnerability as a code injec...

CVE-2025-12267 abhicodebox ModernShop search cross site scripting

A flaw has been found in abhicodebox ModernShop 20250922. This issue affects some unknown processing of the file /search. Executing manipulation of the argument q can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used...

CVE-2025-12267 abhicodebox ModernShop search cross site scripting

A flaw has been found in abhicodebox ModernShop 20250922. This issue affects some unknown processing of the file /search. Executing manipulation of the argument q can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used...