PT-2025-29840 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.5 Description: WeGIA is an open source web manager designed for the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability exists in the adicionar especie.php endpoint. Thi...

Chall-Manager's scenario decoding process does not check for zip bombs

Impact When decoding a scenario i.e. a zip archive, the size of the decoded content is not checked, potentially leading to zip bombs decompression. Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly...

CVE-2025-32053 affecting package libsoup for versions less than 3.0.4-6

CVE-2025-32053 affecting package libsoup for versions less than 3.0.4-6. A patched version of the package is available...

OS Command Injection

mcp-remote is vulnerable to OS command injection. The vulnerability is due to crafted input from the authorizationendpoint response URL when connecting to untrusted MCP servers, which allows an attacker to execute arbitrary operating system commands...

BELL-CVE-2025-38259

Bulletin has no description...

BELL-CVE-2025-38250

Bulletin has no description...

BELL-CVE-2025-27614

Bulletin has no description...

BELL-CVE-2025-27613

Bulletin has no description...

BELL-CVE-2025-38245

Bulletin has no description...

BELL-CVE-2025-38249

Bulletin has no description...

Timing Attack

parisneo/lollms is vulnerable to timing attack. The vulnerability is due to the use of Python's default string equality operator for password comparison, which causes variable response times based on matching characters — allowing an attacker to enumerate valid usernames and incrementally guess...

PT-2025-28975 · Dradis · Dradis

Name of the Vulnerable Software and Affected Versions: Dradis versions prior to 4.11.0 Description: The Dradis Output Console displays a job queue that may reveal information pertaining to jobs belonging to other users. Recommendations: Update to version 4.11.0 or later...

PT-2025-29150 · Unknown +1 · Cpp-Httplib +1

Name of the Vulnerable Software and Affected Versions: cpp-httplib versions prior to 0.20.1 Description: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Versions prior to 0.20.1 do not have a limit for a unique line, which allows an attacker to allocate memory...

CVE-2023-50458

In Dradis before 4.11.0, the Output Console shows a job queue that may contain information about other users' jobs...

Allworx System Software 跨站脚本漏洞

Allworx System Software is a communication software platform from Allworx Corporation. A security vulnerability exists in Allworx System Software version v9.1.9.12, which stems from improper handling of the SessionID parameter in the Admin Login page, which could lead to a cross-site scripting...

IBM Analytics Content Hub 代码问题漏洞

IBM Analytics Content Hub is a clean streaming experience from International Business Machines IBM that visualizes relevant analytics by extracting content from IBM and other analytics providers. A code issue vulnerability exists in IBM Analytics Content Hub versions 2.0, 2.1, 2.2, and 2.3 that...

WordPress Sharable Password Protected Posts plugin < 1.1.1 - Unauthenticated Password Protect Post Access vulnerability

Unauthenticated Password Protect Post Access vulnerability discovered by Pierre Rudloff in WordPress Plugin Sharable Password Protected Posts versions 1.1.1...

Command Injection

mcp-server-kubernetes is vulnerable to Command Injection. The vulnerability is due to unsanitized command execution due to direct use of unvalidated user input in childprocess.execSync, allowing injection of shell metacharacters and execution of arbitrary system commands...

GHSA-JMRV-RXGR-PHVR Jenkins Applitools Eyes Plugin vulnerability does not mask API keys on its job configuration form

Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not mask Applitools API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

Jenkins Git Parameter Plugin vulnerable to code injection due to inexhaustive parameter check

Jenkins Git Parameter Plugin implements a choice build parameter that lists the configured Git SCM’s branches, tags, pull requests, and revisions. Git Parameter Plugin 439.vb0e46ca14534 and earlier does not validate that the Git parameter value submitted to the build matches one of the offered...