编号撤回

PyTorch is a Python package in the PyTorch open source. This CVE number has been withdrawn...

Apache Seata 安全漏洞

Apache Seata is an open source project from the Apache Foundation that provides high-performance and easy-to-use distributed transaction services in a microservices architecture. A security vulnerability exists in Apache Seata version 2.2.0 and earlier, which stems from improper handling of highl...

libzvbi 输入验证错误漏洞

libzvbi is a VBI utility in the zapping-vbi open source. An input validation error vulnerability exists in libzvbi version 0.2.43 and earlier, which stems from an integer overflow and could lead to a remote attack...

E-Commerce-Website-Using-PHP 注入漏洞

E-Commerce-Website-Using-PHP is a free and open source full-featured e-commerce website project. An injection vulnerability exists in E-Commerce-Website-Using-PHP version 1.0, which stems from the fact that incorrect manipulation of the parameter pcat can lead to SQL injection...

Code-Projects Blood Bank Management System 注入漏洞

Code-Projects Blood Bank Management System is an open source blood bank management system from Code-Projects. An injection vulnerability exists in Code-Projects Blood Bank Management System version 1.0, which stems from an incorrect manipulation of the parameter requesterid that can lead to SQL...

Malicious code in calculated_members_message (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5529e99d26fab951551b850892343db8270230c71da1a8091e2bca79559e37f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Android Security Bulletin—March 2025Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2025-03-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

CVE-2024-47830

Plane is an open-source project management tool. Plane uses the wildcard support to retrieve the image from any hostname as in /web/next.config.js. This may permit an attacker to induce the server side into performing requests to unintended locations. This vulnerability is fixed in 0.23.0...

CVE-2024-31461

Plane, an open-source project management tool, has a Server-Side Request Forgery SSRF vulnerability in versions prior to 0.17-dev. This issue may allow an attacker to send arbitrary requests from the server hosting the application, potentially leading to unauthorized access to internal systems. T...

[SECURITY] Fedora 41 Update: abseil-cpp-20240722.1-1.fc41

Abseil is an open-source collection of C++ library code designed to augment the C++ standard library. The Abseil library code is collected from Google's own C++ code base, has been extensively tested and used in production, and is the same code we depend on in our daily coding lives. In some case...

CVE-2025-21616

Plane is an open-source project management tool. A cross-site scripting XSS vulnerability has been identified in Plane versions prior to 0.23. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims'...

CVE-2025-21616 Plane has a Cross-site scripting (XSS) via SVG image upload

Plane is an open-source project management tool. A cross-site scripting XSS vulnerability has been identified in Plane versions prior to 0.23. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims'...

CVE-2025-21616 Plane has a Cross-site scripting (XSS) via SVG image upload

Plane is an open-source project management tool. A cross-site scripting XSS vulnerability has been identified in Plane versions prior to 0.23. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims'...

1000 Projects Portfolio Management System MCA 注入漏洞

1000 Projects Portfolio Management System MCA is an open source portfolio management system from 1000 Projects. An injection vulnerability exists in 1000 Projects Portfolio Management System MCA version 1.0, which stems from a parameter q in the file /updatepersonaldetails.php that can lead to SQ...

Malicious code in app-settings-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis eb5bad98414af86d07823241157507b0c2c71fb619cb487fb0a126587fa9ae8e The OpenSSF Package Analysis project identified 'app-settings-template' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

CVE-2024-11319 Stored XSS in Open Source Project "django-cms"

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in django CMS Association django-cms allows Cross-Site Scripting XSS. This issue affects django-cms: 3.11.7, 3.11.8, 4.1.2, 4.1.3...

Malicious code in libnpmpublishing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 000ac1f9e3e24873823d90fa6c4785583e0f65c86d7c26847dd8819079f1e6e7 The OpenSSF Package Analysis project identified 'libnpmpublishing' @ 99.3.5 npm as malicious. It is considered malicious because: - The package...

Intel Neural Compressor 输入验证错误漏洞

Intel Neural Compressor is an open source project from Intel Corporation USA designed to help developers easily implement AI model optimization. An input validation error vulnerability exists in Intel Neural Compressor versions prior to v3.0, which stems from improper input validation. An attacke...

Exploit for CVE-2024-42845

invesalius3vulnerabilities Intro The https://github.com/...

CVE-2024-3799

Insecure handling of POST header parameter body included in requests being sent to an instance of the open-source project Phoniebox allows an attacker to create a website, which – when visited by a user – will send malicious requests to multiple hosts on the local network. If such a request reach...