PT-2025-18389 · Elastic · Kibana

Name of the Vulnerable Software and Affected Versions: Kibana affected versions not specified Description: The issue allows for the unrestricted upload of files with dangerous types, potentially leading to arbitrary JavaScript execution in a victim's browser, resulting in a cross-site scripting X...

PT-2025-18626 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A use-after-free issue has been identified in the Linux kernel's Bluetooth L2CAP implementation. This occurs when the l2cap recv frame function is invoked to receive data, and the...

CVE-2025-44843

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

goTenna Mesh 安全漏洞

goTenna Mesh is a portable mesh networking device from goTenna that builds decentralized communication networks through intelligent routing algorithms and supports offline transmission of text/location/emergency signals from smartphones. A security vulnerability exists in goTenna Mesh that stems...

CVE-2024-12706

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in OpenText™ Digital Asset Management. T he vulnerability could allow an authenticated user to run arbitrary SQL commands on the underlying database. This issue affects Digital Asset Management.:...

@angular-devkit/build-angular (>=20.0.0-next.7, <=20.0.0-next.8), @angular/build (>=20.0.0-next.7, <=20.0.0-next.8) +31 more potentially affected by CVE-2025-46565 via vite (>=6.3.0, <=6.3.3)

vite NPM version =6.3.0, =20.0.0-next.7, =20.0.0-next.7, =1.92.0, =0.0.10, =1.0.101, =0.0.1, =2.15.20, =0.2.0, =0.2.5 - @nebula-db/orm 0.2.3 - @nebula-db/plugin-cache 0.2.3 and more Source cves: CVE-2025-46565 Source advisory: OSV:GHSA-859W-5945-R5V3...

CVE-2025-43854

DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to...

MAL-2025-3553 Malicious code in internal-payroll-lib-v3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f2f9ac4669489d305522859900c9fc0c92c656de17f018f9369aee637348083 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Plugin Aeropage Sync for Airtable File Upload Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A file upload vulnerability...

PT-2025-18241 · Delta Electronics · Ispsoft

Name of the Vulnerable Software and Affected Versions: Delta Electronics ISPSoft version 3.20 Description: The issue is related to an Out-Of-Bounds Write vulnerability that could allow an attacker to execute arbitrary code when parsing a DVP file. Recommendations: For Delta Electronics ISPSoft...

PT-2025-18319 · Xwiki · Xwiki Contrib'S Syntax Markdown

Name of the Vulnerable Software and Affected Versions: XWiki Contrib's Syntax Markdown versions 8.2 through 8.8 Description: The issue allows any user to embed Javascript code using Markdown syntax, which can be executed on the browser of other users visiting the document or comment containing it...

Data exposure via ZeroMQ on multi-node vLLM deployment

Impact In a multi-node vLLM deployment, vLLM uses ZeroMQ for some multi-node communication purposes. The primary vLLM host opens an XPUB ZeroMQ socket and binds it to ALL interfaces. While the socket is always opened for a multi-node deployment, it is only used when doing tensor parallelism acros...

MAL-2025-3523 Malicious code in crypto-encrypt-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ef44f851c3516fca1e3dc72236ae2c87cf821ded922150cca14e07ff9b4fbcb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-18172 · Zimbra · Zimbra Collaboration

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions 9.0 through 10.1 Description: A Cross-Site Request Forgery CSRF issue exists in the GraphQL endpoint /service/extension/graphql of Zimbra webmail due to a lack of CSRF token validation. This allows attackers ...

Rails Config File Detected

A Ruby on Rails configuration file have been detected on the target web application. These files may contain sensitive information which could assist an attack to conduct further attacks. No source data...

PT-2025-18165 · Unknown · Code-Projects Student Information Management System

Name of the Vulnerable Software and Affected Versions: code-projects Student Information Management System version 1.0 Description: A critical issue was found in the function cancel. The manipulation of the arguments first name and last name leads to a stack-based buffer overflow. This issue can ...

Important: java-11-amazon-corretto

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE:8u441, 8u441-perf, 11.0.26, 17.0.14, 21.0.6, 24; Oracle GraalVM for JDK:17.0.14, 21.0.6...

CVE-2025-43854 DIFY vulnerable to Clickjacking Attack

DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to...

CVE-2025-32470 Unauthenticated change of IP adress

A remote unauthenticated attacker may be able to change the IP adress of the device, and therefore affecting the availability of the device...

CVE-2025-46653

Formidable aka node-formidable 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." Also, there is a scenario in which only the last two characters of a hexoid string nee...