filelock 安全漏洞

filelock is a Python file locker open source by tox development team. filelock version before 3.20.3 has a security vulnerability , the vulnerability stems from the SoftFileLock implementation of the existence of TOCTOU competition conditions , which may lead to locking operation failure or...

virtualenv 竞争条件问题漏洞

Virtualenv is an open source Python virtual environment builder from Python Packaging Authority. A competing conditional issue vulnerability exists in versions prior to virtualenv 20.36.1, which stems from a TOCTOU vulnerability in the directory creation operation that could lead to a symbolic...

CVE-2025-60046

creationtimestamp| type| source ---|---|--- 2026-01-09 23:07:04+00:00| seen| Telegram/3VMHuZJJpWuQDQD7W2QL9nIMLLhgimFT4vXEohZS6QkxBh0...

CVE-2026-22607

creationtimestamp| type| source ---|---|--- 2026-01-09 17:57:42+00:00| published-proof-of-concept| https://github.com/trailofbits/fickling/security/advisories/GHSA-p523-jq9w-64x9 2026-01-10 03:02:28+00:00| seen| Telegram/S2KXutw1drBgRsxEuEIjByNvXPd-WruEjV0wL9OdN7BsNk 2026-01-10 03:49:53+00:00|...

CVE-2026-0803

creationtimestamp| type| source ---|---|--- 2026-01-09 17:05:10+00:00| published-proof-of-concept| Telegram/uD0qGdbiQ2WHuyBpvE0LEOTm0B0zzJl6HgUASLbk8qQc 2026-01-09 19:09:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbz73hhxuz2m...

CVE-2025-69425 Ruckus vRIoT IoT Controller < 3.0.0.0 Hardcoded Tokens RCE

The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 GA expose a command execution service on TCP port 2004 running with root privileges. Authentication to this service relies on a hardcoded Time-based One-Time Password TOTP secret and an embedded static token. An attacker who...

CVE-2025-59818

creationtimestamp| type| source ---|---|--- 2026-01-09 14:14:29+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115865555268914985 2026-02-04 11:18:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdzqvyl6bh2x 2026-08-29 20:00:23+00:00| seen|...

CVE-2025-13897

creationtimestamp| type| source ---|---|--- 2026-01-09 13:05:34+00:00| seen| Telegram/AGJsClzs7lPfqLOjvN9BoXsrmzIKG2pVKSyr843qoYc 2026-01-09 13:28:11+00:00| seen| https://gist.github.com/Darkcrai86/f7830be956257ae4029829269eac2c19 2026-01-09 14:55:45+00:00| seen|...

CVE-2025-13704

creationtimestamp| type| source ---|---|--- 2026-01-09 13:04:47+00:00| seen| Telegram/Q6W0k1WKh9B3-4oN0DiaBhUByTzqYQ-BzTWUpEPQoF3Zxk 2026-01-09 13:27:30+00:00| seen| https://gist.github.com/Darkcrai86/1331776c53ad6518bf921578dab0c3d4 2026-01-09 15:11:46+00:00| seen|...

CVE-2023-45467

Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ntpServIP parameter in the Time Settings...

CVE-2025-66049 Unprotected RTSP stream in Vivotek IP7137 cameras

Vivotek IP7137 camera with firmware version 0200a is vulnerable to an information disclosure issue where live camera footage can be accessed through the RTSP protocol on port 8554 without requiring authentication. This allows unauthorized users with network access to view the camera's feed,...

CVE-2021-41946

In FiberHome VDSL2 Modem HG150-UbV3.0, a stored cross-site scripting XSS vulnerability in Parental Control -- Access Time Restriction -- Username field, a user cannot delete the rule due to the XSS...

CVE-2021-33097

Time-of-check time-of-use vulnerability in the Crypto API Toolkit for IntelR SGX may allow a privileged user to potentially enable escalation of privilege via network access...

CVE-2021-28022

Blind SQL injection in the login form in ServiceTonic Helpdesk software 9.0.35937 allows attacker to exfiltrate information via specially crafted HQL-compatible time-based SQL queries...

CVE-2021-28419

The "ordercol" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads to the ability to retrieve all databases...

CVE-2016-10928

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users...

CVE-2025-40933

Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely. Session ids are generated using an MD5 hash of the epoch time and a call to the built-in rand function. The epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is...

CVE-2022-38922

BluePage CMS thru 3.9 processes an insufficiently sanitized HTTP Header Cookie value allowing MySQL Injection in the 'users-cookie-settings' token using a Time-based blind SLEEP payload...

CVE-2022-38311

Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the time parameter at /goform/PowerSaveSet...

CVE-2022-37450

Go Ethereum aka geth through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making RUM, as exploited in the wild in 2020 through 2022...