PT-2026-26141

HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the cram decode slice function called while reading CRAM records, validation of the reference id field occurred too late, allowing two out of bounds...

PT-2026-21332

Name of the Vulnerable Software and Affected Versions GIMP versions prior to 3.0.8-5 Description A heap-buffer-overflow exists when processing specially crafted PSD Photoshop Document files. The issue occurs within the fread pascal string function because the buffer allocated for a Pascal string ...

PT-2026-29136

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.2 Description FreeRDP is a free implementation of the Remote Desktop Protocol. The progressive decompress tile upgrade function detects a mismatch through progressive rfx quant cmp equal but only emits a warning,...

PT-2026-20913

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.9 Description SPIP versions before 4.4.9 contain a Blind Server-Side Request Forgery SSRF issue related to syndicated sites within the private area. The application does not validate the syndication URL when editing ...

CVE-2025-69288 Titra has Remote Code Execution in Admin Functionality

Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the database. The value is then passed to a NodeVM value to execute as code. Without sanitization, it leads to a Remote Code Execution. Version...

EUVD-2025-206040

Missing Authorization vulnerability in Nik Melnik Realbig allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Realbig: from n/a through 1.1.3...

CVE-2025-62121

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Imran Emu Logo Slider , Logo Carousel , Logo showcase , Client Logo tc-logo-slider allows Stored XSS.This issue affects Logo Slider , Logo Carousel , Logo showcase , Client Logo: from n/a through =...

WordPress Consulting theme <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis in WordPress Theme Consulting versions = 1.5.0...

CVE-2025-13029

creationtimestamp| type| source ---|---|--- 2025-12-31 06:37:22+00:00| seen| https://bsky.app/profile/potato.software/post/3mbbaupnewh24 2026-01-02 15:22:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbh75gxx7u2p 2026-01-02 18:50:33+00:00| seen|...

BELL-CVE-2023-54312

Bulletin has no description...

BELL-CVE-2025-66861 CVE-2025-66861 does not affect BellSoft software

Bulletin has no description...

WordPress Lexicata plugin <= 1.0.16 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by 0xd4rk5id3 - EnvoraSec in WordPress Plugin Lexicata versions = 1.0.16...

The vulnerability of the backup software regarding incorrect use of standard permissions allows a perpetrator to escalate their privileges and execute arbitrary commands.

The vulnerability of the backup software relates to errors in the use of standard permissions. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute arbitrary commands by sending a specially created file...

CVE-2024-58315

Tosibox Key Service 3.3.0 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can exploit the service startup process by inserting malicious code in the system root path, enabling unauthorize...

CVE-2022-50798

Removed by vendor...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization when the frontend.enableExecuteMultiOperation is enabled. An attacker can circumvent namespace-specific validation and feature gates by setting the embedded StartWorkflowExecutionRequest's namespace field to a...

CVE-2025-15262

A security flaw has been discovered in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/edit.php of the component Site Logo Handler. Performing a manipulation of the argument image results in unrestricted upload. Remote exploitation of the attack is possible. The...

CVE-2025-69204

CVE-2025-69204 (ImageMagick) : In ImageMagick prior to 7.1.2-12, the WriteSVGImage function used an int to store number_attributes, which caused an integer overflow and a subsequent buffer overflow, enabling a DoS. Affected product/version: ImageMagick before 7.1.2-12. Impact per the description:...

CVE-2025-68618 Magick's failure to limit the depth of SVG file reads caused a DoS attack.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue...

DEBIAN-CVE-2023-54297

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix memory leak after finding block group with super blocks At excludesuperstripes, if we happen to find a block group that has super blocks mapped to it and we are on a zoned filesystem, we error out as this is not...