31160 matches found
PT-2025-20162 · Unknown · Themefic Beaf
Name of the Vulnerable Software and Affected Versions: Themefic BEAF versions through 4.6.10 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can be exploited to gain unauthorized access to the server...
CVE-2025-2784 affecting package libsoup for versions less than 3.4.4-5
CVE-2025-2784 affecting package libsoup for versions less than 3.4.4-5. A patched version of the package is available...
CVE-2024-3447 affecting package qemu for versions less than 8.2.0-14
CVE-2024-3447 affecting package qemu for versions less than 8.2.0-14. A patched version of the package is available...
CVE-2025-46421 affecting package libsoup for versions less than 3.0.4-5
CVE-2025-46421 affecting package libsoup for versions less than 3.0.4-5. A patched version of the package is available...
WordPress WZ Followed Posts plugin <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by muhammad yudha in WordPress Plugin WZ Followed Posts - Display what visitors are reading versions = 3.1.0...
CVE-2025-46815
ZITADEL Session API vulnerability (CVE-2025-46815) allows token/id reuse from idp intents prior to versions 3.0.0, 2.71.9, and 2.70.10. An attacker with URI access could obtain the id and token and authenticate on behalf of the user. MFA prevents full authentication, but this exposes a partial au...
Terraform WinDNS Provider improperly sanitizes input variables in `windns_record`
Impact: A security issue has been found in terraform-provider-windns before version 1.0.5. The windnsrecord resource did not santize the input variables. This can lead to authenticated command injection in the underlyding powershell command prompt. Patches: 83ef736 fix: better input validation...
GHSA-4VGF-2CM4-MP7C Terraform WinDNS Provider improperly sanitizes input variables in `windns_record`
Impact: A security issue has been found in terraform-provider-windns before version 1.0.5. The windnsrecord resource did not santize the input variables. This can lead to authenticated command injection in the underlyding powershell command prompt. Patches: 83ef736 fix: better input validation...
ruby:3.3 security update
ruby 3.3.8-4 - Upgrade to Ruby 3.3.8. Resolves: RHEL-86933 - Fix Net::IMAP vulnerable to possible DoS by memory exhaustion. CVE-2025-25186 - Fix Denial of Service in CGI::Cookie.parse. CVE-2025-27219 Resolves: RHEL-87182 - Fix userinfo leakage in URIjoin, URImerge and URI+. CVE-2025-27221...
Azure Linux 3.0 Security Update: kernel (CVE-2025-21959)
The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21959 advisory. - In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconncount: Fully initialize...
PT-2025-19828 · Unknown · Phpgurukul Art Gallery Management System
Name of the Vulnerable Software and Affected Versions: PHPGurukul Art Gallery Management System version 1.1 Description: A critical issue affects an unknown functionality of the file /admin/add-art-type.php. The manipulation of the arttype argument leads to SQL injection. This issue can be...
PT-2025-19831 · Sourcecodester · Sourcecodester Advanced Web Store
Name of the Vulnerable Software and Affected Versions: SourceCodester Advanced Web Store version 1.0 Description: A critical issue has been found in the processing of the file /productdetail.php. The manipulation of the prodid argument leads to SQL injection. The attack may be initiated remotely...
ruby:3.1 security update
ruby 3.1.7-146 - Upgrade to Ruby 3.1.7. Resolves: RHEL-55410 - Fix DoS vulnerability in REXML. CVE-2024-39908 Resolves: RHEL-86077...
CVE-2025-46340
Misskey is an open source, federated social media platform. Starting in version 12.0.0 and prior to version 2025.4.1, due to an oversight in the validation performed in UrlPreviewService and MkUrlPreview, it is possible for an attacker to inject arbitrary CSS into the MkUrlPreview component...
CVE-2025-46553
@misskey-dev/summaly is a tool for getting a summary of a web page. Starting in version 3.0.1 and prior to version 5.2.1, a logic error in the main summaly function causes the allowRedirects option to never be passed to any plugins, and as a result, isn't enforced. Misskey will follow redirects,...
GHSA-HG9M-67MM-7PG3 Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields
Summary field.isFilterable access control can be bypassed in update and delete mutations by adding additional unique filters. These filters can be used as an oracle to probe the existence or value of otherwise unreadable fields. Specifically, when a mutation includes a where clause with multiple...
Security Bulletin: Vulnerability in jinja2 affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2024-56201, CVE-2024-56326].
Summary The jinja2 package is used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2024-56201, CVE-2024-56326. Vulnerability Details CVEID:CVE-2024-56201 DESCRIPTION: Jinja is an extensible templating engine. In versions on the 3.x bran...
CVE-2024-51991 October CMS Allows Unprotected SVG Rename in Media Manager
October is a Content Management System CMS and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administrators with sites that have the media.cleanvectors configuration enabled. This configuration will sanitize SVG files uploaded using the media manager. This...