16949 matches found
Jenkins Credentials Binding Plugin vulnerability can expose sensitive information in logger messages
Jenkins Credentials Binding Plugin 687.v619cb15e923f and earlier does not properly mask i.e., replace with asterisks credentials present in exception error messages that are written to the build log. Credentials Binding Plugin 687.689.v1af775332fc9 rethrows exceptions that contain credentials,...
GHSA-6XPM-GGF7-WC3P mcp-remote exposed to OS command injection via untrusted MCP server connections
mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorizationendpoint response URL...
BELL-CVE-2025-48386
Bulletin has no description...
BELL-CVE-2025-7345
Bulletin has no description...
BELL-CVE-2025-38237
Bulletin has no description...
BELL-CVE-2025-48384
Bulletin has no description...
Regular Expression Denial Of Service (ReDoS)
transformers is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to a flawed regular expression pattern used in the getimports function to filter try/except blocks, which allows an attacker to craft input strings that cause catastrophic backtracking...
PT-2025-29097 · Ibm · Ibm Analytics Content Hub
Name of the Vulnerable Software and Affected Versions: IBM Analytics Content Hub versions 2.0 through 2.3 Description: The software may reveal detailed technical error messages, potentially exposing information about the application framework to a remote attacker. This information could be used f...
mcp-remote 操作系统命令注入漏洞
mcp-remote is an MCP linking software by the individual developer Glen Maddern. An operating system command injection vulnerability exists in mcp-remote, which stems from the presence of OS command injection when connecting to an untrusted MCP server...
PT-2025-29076 · Gitlab · Gitlab Ce/Ee
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 17.11 through 17.11.5 GitLab CE/EE versions 18.0 through 18.0.3 GitLab CE/EE versions 18.1 through 18.1.1 Description: An issue has been discovered in GitLab CE/EE that, under certain conditions, could allow an attacker ...
CVE-2025-49604
For Realtek AmebaD devices, a heap-based buffer overflow was discovered in Ameba-AIoT ameba-arduino-d before version 3.1.9 and ameba-rtos-d before commit c2bfd8216a1cbc19ad2ab5f48f372ecea756d67a on 2025/07/03. In the WLAN driver defragment function, lack of validation of the size of fragmented...
PT-2025-28958 · Builder.Io · @Builder.Io/Qwik-City
Name of the Vulnerable Software and Affected Versions: @builder.io/qwik-city versions prior to 1.13.0 Description: The @builder.io/qwik-city meta-framework for Qwik is susceptible to an issue where improper handling of invalid qfunc during the execution of a Qwik Server Action QRL can lead to a...
WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via redirectURL Parameter vulnerability discovered by Asaf Mozes in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.5.10...
Qualcomm WLAN Software Vulnerability - Lenovo Support US
No description provided...
Remote Code Execution (RCE)
github.com/lf-edge/ekuiper is vulnerable to Remote Code Execution RCE. The vulnerability is due to insufficient restrictions in the /config/uploads API, allowing directory traversal ../ to write files outside the intended directory, potentially leading to remote code execution if run with root...
CVE-2025-49729
creationtimestamp| type| source ---|---|--- 2025-07-08 15:56:31+00:00| seen| https://www.thezdi.com/blog/2025/7/8/the-july-2025-security-update-review 2025-07-08 20:30:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lti5ejncff2w...
WordPress smart SEO plugin <= 4.0 - SQL Injection Vulnerability
SQL Injection Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme smart SEO versions = 4.0...
BELL-CVE-2025-38226
Bulletin has no description...