PT-2026-32160

Faleemi Desktop Software 1.8 contains a local buffer overflow vulnerability in the System Setup dialog that allows attackers to bypass DEP protections through structured exception handling exploitation. Attackers can inject a crafted payload into the Save Path for Snapshot and Record file field t...

SUSE CVE-2025-45806

A cross-site scripting XSS vulnerability in rrweb-snapshot before v2.0.0-alpha.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

EUVD-2025-209373

A cross-site scripting XSS vulnerability in rrweb-snapshot before v2.0.0-alpha.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

org.webjars.npm:rrweb (1.0.7), org.webjars.npm:rrweb-player (0.7.9) potentially affected by CVE-2025-45806 via org.webjars.npm:rrweb-snapshot (1.1.10)

org.webjars.npm:rrweb-snapshot MAVEN version 1.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:rrweb-snapshot and may be impacted: - org.webjars.npm:rrweb 1.0.7 - org.webjars.npm:rrweb-player 0.7.9 Source cves: CVE-2025-45806 Sourc...

Cross-site Scripting (XSS)

Overview rrweb-snapshot is a rrweb's component to take a snapshot of DOM, aka DOM serializer Affected versions of this package are vulnerable to Cross-site Scripting XSS via the rrweb-snapshot process. An attacker can execute arbitrary web scripts or inject malicious HTML by submitting a speciall...

Cross-site Scripting (XSS)

Overview org.webjars.npm:rrweb-snapshot is a rrweb's component to take a snapshot of DOM, aka DOM serializer Affected versions of this package are vulnerable to Cross-site Scripting XSS via the rrweb-snapshot process. An attacker can execute arbitrary web scripts or inject malicious HTML by...

@100mslive/roomkit-react (>=0.1.0, <=0.1.4-alpha.1), @18ways/mdx-translate (>=0.1.0-alpha.1011313d2aaf, <=0.1.0-alpha.9d8992d35859) +1172 more potentially affected by CVE-2025-45806 via rrweb-snapshot (>=0.6.11, <=2.1.1)

rrweb-snapshot NPM version =0.6.11, =0.1.0, =0.1.0-alpha.1011313d2aaf, =1.0.1, =1.1.0-alpha.1011313d2aaf, =2.32.12, =0.0.220, =0.0.215, =0.0.237, =1.2.0-1, =0.1.0, =0.0.0-canary.4c9336fa.20260814114910, =0.0.0-canary.4c9336fa.20260814114910, =0.1.0, =0.3.4, =0.0.1, =0.0.2 and more Source cves:...

CVE-2025-45806

A cross-site scripting XSS vulnerability in rrweb-snapshot before v2.0.0-alpha.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

PT-2026-31610

A cross-site scripting XSS vulnerability in rrweb-snapshot before v2.0.0-alpha.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2025-45806

A cross-site scripting XSS vulnerability in rrweb-snapshot before v2.0.0-alpha.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

Directus 安全漏洞

Directus is an open-source real-time API and application dashboard developed by Directus. It is used to manage SQL database content. Versions of Directus prior to 11.17.0 contained a security vulnerability. This vulnerability stemmed from inconsistent calls to the prepareDelta cleanup pipeline in...

CVE-2025-45806

A cross-site scripting XSS vulnerability in rrweb-snapshot before v2.0.0-alpha.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2025-45806

A cross-site scripting XSS vulnerability in rrweb-snapshot before v2.0.0-alpha.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2025-45806

CVE-2025-45806 describes a cross-site scripting (XSS) vulnerability in the rrweb-snapshot package prior to 2.0.0-alpha.18 . An attacker can inject a crafted payload to execute arbitrary scripts in affected environments. Affected component: rrweb-snapshot (DOM serialization). Underlying issue cite...

CVE-2025-45806

A cross-site scripting XSS vulnerability in rrweb-snapshot before v2.0.0-alpha.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients

Summary Before OpenClaw 2026.4.2, the Gateway connect success snapshot exposed local configPath and stateDir metadata to non-admin clients. Low-privilege authenticated clients could learn host filesystem layout and deployment details that were not needed for their role. Impact A non-admin client...

Security Bulletin: IBM Operations Analytics - Log Analysis is affected by insufficiently privileged clients to execute snapshot and restore commands due to Apache Zookeeper

Summary Apache Zookeeper in Apache Solr is used by IBM Operations Analytics - Log Analysis as part of the coordination and configuration management backbone for SolrCloud. CVE-2025-58457. Vulnerability Details CVEID:CVE-2025-58457 DESCRIPTION: Improper permission check in ZooKeeper AdminServer le...

The vulnerability of the `snapshot_write()` and `snapshot_ioctl()` functions in the kernel/power/user.c module of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the snapshotwrite and snapshotioctl functions in the kernel/power/user.c module of the Linux operating system is related to the occurrence of mutual locking. Exploiting this vulnerability could allow an attacker to cause a service failure...

PYSEC-2026-2130

changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the jq: and jqraw: include filter expressions allow use of the jq env builtin, which reads all process environment variables and stores them as the watch snapshot. An authenticated user or unauthenticated us...

CVE-2026-33981

changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the jq: and jqraw: include filter expressions allow use of the jq env builtin, which reads all process environment variables and stores them as the watch snapshot. An authenticated user or unauthenticated us...