16950 matches found
CVE-2025-25975
An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function...
MAL-2025-2277 Malicious code in retool-quickopen-extension (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 042613c8964cff510d8e7c399f8af5d2d64e787d61c331e0e3104ff349147412 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-2274 Malicious code in react-textfit-example (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cd133ed4ff9a23964d050578a197c7d8d9a45ba07d60f2d3b031b350bae49370 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-28868 WordPress ZipList Recipe plugin <= 3.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in ZipList ZipList Recipe ziplist-recipe-plugin allows Cross Site Request Forgery.This issue affects ZipList Recipe: from n/a through = 3.1...
CVE-2025-27773
CVE-2025-27773 affects the SimpleSAMLphp SAML2 library. A signature confusion attack exists in the HTTPRedirect binding where an attacker who has any signed SAMLResponse can cause the application to accept an unsigned message. This impacts versions prior to 4.17.0 and 5.0.0-alpha.20. The issue is...
CVE-2025-1382
The Contact Us By Lord Linus WordPress plugin through 2.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...
BELL-CVE-2023-52971
Bulletin has no description...
BELL-CVE-2023-52970
Bulletin has no description...
CVE-2025-25977
A flaw was found in the canvg library. In affected versions, an attacker can manipulate the input to the StyleElement constructor to inject or alter properties within the global prototype chain. This can lead to other injection-based attacks, particularly if the library is integrated into an...
PT-2025-10750 · Mrcms · Mrcms
Name of the Vulnerable Software and Affected Versions: MRCMS version 3.1.2 Description: A critical issue has been discovered that affects the delete function of the /admin/file/delete.do endpoint, specifically within the org.marker.mushroom.controller.FileController component. The manipulation of...
PT-2025-10767 · Fortinet · Fortiweb
Name of the Vulnerable Software and Affected Versions: Fortinet FortiWeb versions 7.0.0 through 7.0.10 Fortinet FortiWeb versions 7.2.0 through 7.2.10 Fortinet FortiWeb versions 7.4.0 through 7.4.6 Description: The issue is related to the improper handling of syntactically invalid structures,...
PT-2025-10895 · Unknown · Aitangbao Springboot-Manager
Name of the Vulnerable Software and Affected Versions: aitangbao springboot-manager version 3.0 Description: A problematic vulnerability has been found in aitangbao springboot-manager, affecting an unknown part of the file /sys/permission. The manipulation of the name argument leads to cross-site...
PT-2025-10700 · Libzvbi +5 · Libzvbi +5
Name of the Vulnerable Software and Affected Versions: libzvbi versions 0.2.43 and earlier Description: A problem has been found in the function vbi strndup iconv ucs2 of the file src/conv.c. The manipulation of the argument src length leads to an uninitialized pointer. It is possible to launch t...
canvg Prototype Pollution vulnerability
An issue in canvg prior to v.4.0.3 and v3.0.11 can lead to prototype pollution via the Constructor of the class StyleElement...
Remote Code Execution (RCE)
DGL is vulnerable to Remote Code Execution RCE.The vulnerability is due to unsafe deserialization due to the use of Python's pickle module for serializing and deserializing network messages, which can allow attackers to execute arbitrary code remotely...
Laravel framework susceptible to reflected cross-site scripting
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page...
BIT-DJANGO-2025-26699
An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings...
PT-2025-10589
Name of the Vulnerable Software and Affected Versions Open Asset Import Library Assimp version 5.4.3 Description A critical issue has been found in the Open Asset Import Library Assimp, affecting the function Assimp::BaseImporter::ConvertToUTF8 of the file BaseImporter.cpp in the File Handler...