CVE-2025-49598

conda-forge-ci-setup is a package installed by conda-forge each time a build is run on CI. The conda-forge-ci-setup-feedstock setup script is vulnerable due to the unsafe use of the eval function when parsing version information from a custom-formatted meta.yaml file. An attacker controlling...

CVE-2025-49598

conda-forge-ci-setup is a package installed by conda-forge each time a build is run on CI. The conda-forge-ci-setup-feedstock setup script is vulnerable due to the unsafe use of the eval function when parsing version information from a custom-formatted meta.yaml file. An attacker controlling...

CVE-2025-49598

Summary: CVE-2025-49598 affects the conda-forge-ci-setup package (and its feedstock setup script) via an unsafe use of eval when parsing version information from a custom-formatted meta.yaml. An attacker who can modify the recipe (RECIPE_DIR) and supply a malicious meta.yaml can cause arbitrary c...

CVE-2025-49598 conda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version Parsing

conda-forge-ci-setup is a package installed by conda-forge each time a build is run on CI. The conda-forge-ci-setup-feedstock setup script is vulnerable due to the unsafe use of the eval function when parsing version information from a custom-formatted meta.yaml file. An attacker controlling...

CVE-2025-49598 conda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version Parsing

conda-forge-ci-setup is a package installed by conda-forge each time a build is run on CI. The conda-forge-ci-setup-feedstock setup script is vulnerable due to the unsafe use of the eval function when parsing version information from a custom-formatted meta.yaml file. An attacker controlling...

CVE-2025-49598 conda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version Parsing

conda-forge-ci-setup is a package installed by conda-forge each time a build is run on CI. The conda-forge-ci-setup-feedstock setup script is vulnerable due to the unsafe use of the eval function when parsing version information from a custom-formatted meta.yaml file. An attacker controlling...

PT-2025-25444 · Unknown · Conda-Forge-Ci-Setup

Name of the Vulnerable Software and Affected Versions: conda-forge-ci-setup versions prior to 4.15.0 Description: The conda-forge-ci-setup-feedstock setup script is vulnerable due to the unsafe use of the eval function when parsing version information from a custom-formatted meta.yaml file. An...

conda forge ci-setup 安全漏洞

conda forge ci-setup is an open source library from the conda forge community. A security vulnerability exists in conda forge ci-setup, which stems from the unsafe use of the eval function and could lead to arbitrary code execution...

CVE-2025-49598: Improper Neutralization of Directives in Dynamically Evaluated Code

conda-forge-ci-setup is a package installed by conda-forge each time a build is run on CI. The conda-forge-ci-setup-feedstock setup script is vulnerable due to the unsafe use of the eval function when parsing version information from a custom-formatted meta.yaml file. An attacker controlling...

Exploit for External Control of File Name or Path in Microsoft

CVE-2025-33053 Proof Of Concept This repository provides scri...

Exploit for Use After Free in Apple Ipados

CVE-2025-24252 iOS "Airborne" Vulnerabilities - Log Artifact E...

ALSA-2025:8743 Moderate: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: um: Fix out-of-bounds read in LDT setup CVE-2022-49395 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refe...

CVE-2025-49004 Hijacking Caido instance during the initial setup via DNS Rebinding to achieve RCE

Caido is a web security auditing toolkit. Prior to version 0.48.0, due to the lack of protection for DNS rebinding, Caido can be loaded on an attacker-controlled domain. This allows a malicious website to hijack the authentication flow of Caido and achieve code execution. A malicious website load...

CVE-2025-3582

The Newsletter WordPress plugin (versions prior to 8.85 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient sanitization and escaping of certain Form settings . This flaw allows high-privilege users, such as administrators, to execute malicious scripts even when the unfiltere...

CVE-2025-3581 Newsletter < 8.8.5 - Admin+ Stored XSS via Widget

The Newsletter WordPress plugin before 8.8.5 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtm...

TRENDnet TV-IP121W 授权问题漏洞

TRENDnet TV-IP121W is a night vision wireless camera from Trendnet. An authorization issue vulnerability exists in TRENDnet TV-IP121W version 1.1.1 Build 36, which stems from improper authentication in the file /admin/setup.cgi...

D-Link DIR-816 安全漏洞

The D-Link DIR-816 is a wireless router from China's AUO D-Link. The D-Link DIR-816 suffers from a buffer overflow vulnerability, which originates from the failure of the QoSPortSetup parameter port0group in the file /goform/QoSPortSetup to correctly validate the length of the input data, which c...

The vulnerability of the QoSPortSetup() function (/goform/QoSPortSetup) of D-Link DIR-816 router microprogramming software allows a hacker to induce a service failure.

The vulnerability of the QoSPortSetup function /goform/QoSPortSetup of the D-Link DIR-816 router’s software is related to buffer overflow in the stack. Exploiting this vulnerability could allow a malicious actor to cause a service failure by sending a specially crafted POST request...

CVE-2025-3584 Newsletter < 8.8.2 - Admin+ Stored XSS via Subscription

The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-3584

The Newsletter WordPress plugin versions prior to 8.8.2 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape certain Subscription settings , which allows high-privilege users (such as admins) to execute arbitrary web scripts or HTML. T...