13073 matches found
Improper Authentication
github.com/mattermost/mattermost-server is vulnerable to improper authentication. The vulnerability is due to the failure to negotiate a new token when accepting an invite, which allows an attacker who intercepts both the invite and password to send synchronization payloads to the original server...
WordPress Educenter Theme <= 1.6.2 is vulnerable to Cross Site Scripting (XSS)
Software Educenter Type Theme Vulnerable versions = 1.6.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2025-5529 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8465b696cfd2 Credits Peter Thaleikis Required privileg...
CVE-2025-54379 eKuiper API endpoints handling SQL queries with user-controlled table names.
LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. In versions before 2.2.1, there is a critical SQL Injection vulnerability in the getLast API functionality of the eKuiper project. This flaw allows unauthenticated remote...
CVE-2025-7404 Calibre Web 0.6.24 & Autocaliweb 0.7.0 - Blind C
Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue affects Calibre Web: 0.6.24 Nicolette; Autocaliweb: from 0.7.0 before 0.7.1...
CGA-Q428-HVH3-33QW
Bulletin has no description...
MAL-2025-6226 Malicious code in react-dom-builtin (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ac7450c93d4fe9acd7455d948757158cfef0776508f78ee3544d4cad40dc18b2 The OpenSSF Package Analysis project identified 'react-dom-builtin' @...
CGA-QG9F-JW8X-WV4H
Bulletin has no description...
MAL-2025-6322 Malicious code in vercel-internal (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-6278 Malicious code in binance-internals (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-6306 Malicious code in retirejs (npm)
The package communicates with a domain associated with malicious activity...
CGA-HC2M-XW7C-3WR5
Bulletin has no description...
CGA-MP9R-PQ3P-Q3QC
Bulletin has no description...
MAL-2025-6317 Malicious code in testandooteste (npm)
The package communicates with a domain associated with malicious activity...
PT-2025-30664
Name of the Vulnerable Software and Affected Versions Bayraktar Solar Energies ScadaWatt Otopilot versions prior to 27.05.2025 Description A SQL Injection issue exists in Bayraktar Solar Energies ScadaWatt Otopilot. The vulnerability is due to improper neutralization of special elements used in a...
CGA-9M6X-QCRX-9XFJ
Bulletin has no description...
CVE-2025-54377 Roo Code Lacks Line Break Validation in its Command Execution Tool
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.23.18 and below, RooCode does not validate line breaks \n in its command input, allowing potential bypass of the allow-list mechanism. The project appears to lack parsing or validation logic to prevent...
CGA-X38X-69C3-6J9R
Bulletin has no description...
CGA-3RWG-FQJ7-R7CF
Bulletin has no description...
Security Bulletin: IBM® Db2® is vulnerable to a denial of service under specific conditions (CVE-2024-52903)
Summary IBM® Db2® is vulnerable to a denial of service under specific conditions with a specially crafted query. Vulnerability Details CVEID:CVE-2024-52903 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to a denial of service as the server may crash und...