CVE-2025-0242

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory...

CVE-2025-22132 WeGIA has a Cross-Site Scripting (XSS) in File Upload Field

WeGIA is a web manager for charitable institutions. A Cross-Site Scripting XSS vulnerability was identified in the file upload functionality of the WeGIA/html/socio/sistema/controller/controlaxlsx.php endpoint. By uploading a file containing malicious JavaScript code, an attacker can execute...

CVE-2025-0241

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash...

CVE-2024-40748

Lack of output escaping in the id attribute of menu lists...

GO-2025-3368 Argument Injection via the URL field in github.com/go-git/go-git

Argument Injection via the URL field in github.com/go-git/go-git...

GO-2025-3364 Karmada PULL Mode Cluster Privilege Escalation in github.com/karmada-io/karmada

Karmada PULL Mode Cluster Privilege Escalation in github.com/karmada-io/karmada...

PT-2025-2878 · Adportal · Adportal

Name of the Vulnerable Software and Affected Versions: AdPortal version 3.0.39 Description: A Server-Side Template Injection SSTI issue was found, allowing a remote attacker to execute arbitrary code via the shippingAsBilling and firstname parameters in the updateuserinfo.html file...

CVE-2024-55627 Suricata segfault on StreamingBufferSlideToOffsetWithRegions

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a specially crafted TCP stream can lead to a very large buffer overflow while being zero-filled during initialization with memset due to an unsigned integer...

GHSA-V6JV-P6R8-J78W NiceGUI On Air authentication issue

Summary Once a user logins to one browser, all other browsers are logged in without entering password. Even incognito mode. Impact high...

Denial Of Service (DoS)

github.com/CosmWasm/wasmd is vulnerable to Denial Of Service DoS. The vulnerability is due to an uncaught exception caused by simulation of Wasmd message...

CVE-2024-20143

In V6 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09167056;...

CVE-2024-20140

In power, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09270402; Issue ID: MSV-2020...

CVE-2024-46209

A stored cross-site scripting XSS vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the password parameter...

CVE-2025-22376

In Net::OAuth::Client in the Net::OAuth package before 0.29 for Perl, the default nonce is a 32-bit integer generated from the built-in rand function, which is not cryptographically strong...

CVE-2025-21609 SiYuan has an arbitrary file deletion vulnerability

SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the POST /api/history/getDocHistoryContent endpoint. An attacker can craft a payload to exploit this vulnerability,...

BREACH Attack

ibexa/post-install is vulnerable to the BREACH attack. The vulnerability is due to improper handling of HTTP compression, allowing secrets to be extracted through carefully crafted requests...

PT-2025-3123 · Codeastro · Codeastro Complaint Management System

Name of the Vulnerable Software and Affected Versions: CodeAstro Complaint Management System version 1.0 Description: The issue allows a remote attacker to escalate privileges via the delete e.php component. Recommendations: For CodeAstro Complaint Management System version 1.0, consider disablin...

PT-2025-3765 · Code Projects · Point Of Sales/Inventory Management System

Name of the Vulnerable Software and Affected Versions: code-projects Point of Sales and Inventory Management System version 1.0 Description: A critical issue affects the processing of the file /user/add cart.php, where the manipulation of the argument id/qty leads to SQL injection. The attack may...

Prototype Pollution

jsii is vulnerable to prototype pollution. The vulnerability is due to insufficient validation of user input. When untrusted input is allowed to modify the prototype of objects, an attacker can inject malicious properties into the object's prototype, potentially altering the behavior of the entir...

Directory Traversal

Gogs is vulnerable to Directory Traversal. The vulnerability is due to improper input handling that allows a malicious user to write a file to an arbitrary path on the server, potentially gaining SSH access...