12580 matches found
PT-2025-31707
Name of the Vulnerable Software and Affected Versions: @nestjs/devtools-integration versions 0.2.0 and below Description: A critical Remote Code Execution RCE vulnerability exists in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with a...
HPESBNW04906 rev.1 - HPE Telco IP Mediation, Multiple Vulnerabilities
Potential Security Impact: Local: Denial of Service DoS, Stack Overflow; Remote: Code Execution, Denial of Service DoS, XML External Entity XXE, Stack Overflow SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco IP Mediation - Prior to 8.5.1-0B CVSS Scores: | CVE | CVSS Vect...
CVE-2025-48073 OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, when reading a deep scanline image with a large sample count in reduceMemory mode, it is possible to crash a target application with a...
CVE-2025-27514
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 9.5.0 through 10.0.18, a technician can use a malicious payload to trigger a stored XSS on the project's kanban. This is fixed in version 10.0.1...
CVE-2025-54589
Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at /?ru, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a block without proper escaping...
CGA-W886-Q38X-5PVW
Bulletin has no description...
RHSA-2025:12332 Red Hat Security Advisory: icu security update
Bulletin has no description...
RHSA-2025:12282 Red Hat Security Advisory: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update
Bulletin has no description...
Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability in the Image Plugin
A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.3 or later...
BIT-DISCOURSE-2025-53102 Discourse's WebAuthn challenge isn't cleared from user session after authentication
Discourse is an open-source community discussion platform. Prior to version 3.4.7 on the stable branch and version 3.5.0.beta.8 on the tests-passed branch, upon issuing a physical security key for 2FA, the server generates a WebAuthn challenge, which the client signs. The challenge is not cleared...
MINI-C6XF-MR69-5H53
Bulletin has no description...
PT-2025-31585
Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.3.0 through 3.3.2 Description OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. A heap-based buffer overflow occurs during a writ...
PT-2025-31591
Name of the Vulnerable Software and Affected Versions MaterialX versions prior to 1.39.3 Description MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. When parsing shader nodes in a MTLX file, the MaterialXCore code...
WordPress WP Modal Popup with Cookie Integration Plugin plugin <= 2.4 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by Que Thanh Tuan Blue Rock in WordPress Plugin WP Modal Popup with Cookie Integration versions = 2.4...
CVE-2025-53944 AutoGPT Platform Exposes Graph Execution Results via Authorization Gap
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents. In v0.6.15 and below, the external API's getgraphexecutionresults endpoint has an authorization bypass vulnerability. While it correctly validates user access to the graphid, it fails ...
CVE-2025-53357
GLPI (Gestionnaire Libre de Parc Informatique) is affected in versions 0.78–10.0.18, where a connected user can alter another user’s reservations. The issue is fixed in version 10.0.19. Affected products: GLPI Asset/IT Management software; impact: permission/reservation modification by an authent...
CVE-2025-54572 Ruby SAML DOS vulnerability with large SAML response
The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ruby-saml even with the messagemaxbytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64...
CVE-2025-54410 Moby's Firewalld reload removes bridge network isolation
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. A firewalld vulnerability affects Moby releases before 28.0.0. When firewalld reloads, Docker fails to re-create...