13073 matches found
CVE-2025-45766
poco v1.14.1-release was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is...
ALSA-2025:13203 Moderate: libxml2 security update
The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: Out-of-bounds Read in xmlSchemaIDCFillNodeTables CVE-2025-32415 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other...
CVE-2025-54883 Vision UI's security-kit Contains Cryptographic Weakness
Vision UI is a collection of enterprise-grade, dependency-free modules for modern web projects. In versions 1.4.0 and below, the getSecureRandomInt function in security-kit versions prior to 3.5.0 packaged in Vision-ui = 1.4.0 contains a critical cryptographic weakness. Due to a silent 32-bit...
CVE-2025-54125 XWiki Platform: Password and email exposure in xml.vm fields
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 1.1 through 16.4.6, 16.5.0-rc-1 through 16.10.4 and 17.0.0-rc-1 through 17.1.0, the XML export of a page in XWiki that can b...
MAL-2025-6792 Malicious code in htmlcontent (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4aa1c1ab3630fc2aad076dcc5fd9b2205ba7e1079410b1de1b6a757690fdd2b1 The OpenSSF Package Analysis project identified 'htmlcontent' @ 3.0.0 npm as malicious. It is considered malicious because: - The package...
WordPress esri-map-view plugin <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via esri-map-view Shortcode vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via esri-map-view Shortcode vulnerability discovered by Gilang in WordPress Plugin esri-map-view versions = 1.2.3...
CGA-VCWR-7247-M88R
Bulletin has no description...
RHSA-2025:12892 Red Hat Security Advisory: redis:7 security update
Bulletin has no description...
RHSA-2025:12842 Red Hat Security Advisory: qt5-qt3d security update
Bulletin has no description...
RHSA-2025:12749 Red Hat Security Advisory: sqlite security update
Bulletin has no description...
CVE-2025-8551 atjiu pybbs list cross site scripting
A vulnerability was found in atjiu pybbs up to 6.0.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/comment/list. The manipulation of the argument Username leads to cross site scripting. The attack may be launched remotely. The exploit h...
BELL-CVE-2025-54350
Bulletin has no description...
Improper Authorization
@haxtheweb/haxcms-nodejs and elmsln/haxcms are vulnerable to Improper Authorization. The vulnerability is due to failure to verify if an authenticated user has permission to interact with a resource before performing operations...
CVE-2025-54804 Russh is missing an overflow check during channel windows adjust
Russh is a Rust SSH client & server library. In versions 0.54.0 and below, the channel window adjust message of the SSH protocol is used to track the free space in the receive buffer of the other side of a channel. The current implementation takes the value from the message and adds it to an...
ALSA-2025:12834 Moderate: python3.12-setuptools security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
CGA-FXJQ-G46F-7R8Q
Bulletin has no description...
WordPress WP Import Export Lite plugin <= 3.9.28 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability
Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Vincent Fourcade vinceMatsui in WordPress Plugin WP Import Export Lite versions = 3.9.28...
MAL-2025-6734 Malicious code in jcr-hopper (npm)
The package communicates with a domain associated with malicious activity...