CVE-2025-56320

Enterprise Contract Management Portal v.22.4.0 is vulnerable to Stored Cross-Site Scripting XSS in its chat box component. This allows a remote attacker to execute arbitrary code. NOTE: the Supplier reports that this is "Present only in an obsolete, unsupported version no longer in circulation."...

GHSA-4MJW-XR5X-PRPC Apache ActiveMQ NMS AMQP Client has a Deserialization of Untrusted Data vulnerability

A Deserialization of Untrusted Data vulnerability exists in the Apache ActiveMQ NMS AMQP Client. This issue affects all versions of Apache ActiveMQ NMS AMQP up to and including 2.3.0, when establishing connections to untrusted AMQP servers. Malicious servers could exploit unbounded deserializatio...

JLSEC-2025-48 nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

nextScaffoldPart in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow...

JLSEC-2025-56 In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

In Expat aka libexpat before 2.4.5, there is an integer overflow in storeRawNames...

JLSEC-2025-55 In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.

In Expat aka libexpat before 2.4.5, there is an integer overflow in copyString...

CVE-2025-11710

A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised process. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4...

CVE-2025-59958

This CVE affects Juniper Networks Junos OS Evolved on PTX Series (Packet Forwarding Engine). Affected component: firewall filters (output, on WAN/revenue interfaces). Root cause: improper handling when action is 'reject' causing matching packets to be sent to the Routing Engine, consuming RE reso...

CVE-2025-32916 Sensitive form data in URL query parameters

Potential use of sensitive information in GET requests in Checkmk GmbH's Checkmk versions 2.4.0p13, 2.3.0p38, 2.2.0p46, and 2.1.0 EOL may cause sensitive form data to be included in URL query parameters, which may be logged in various places such as browser history or web server logs...

WordPress Grevo theme <= 2.4 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by ? in WordPress Theme Grevo versions = 2.4...

Juniper Junos OS Evolved 代码问题漏洞

Juniper Junos OS Evolved is a network operating system from Juniper USA. A code issue vulnerability exists in Juniper Junos OS Evolved versions prior to 22.4R3-EVO and 23.2 to prior to 23.2R2-EVO, which arises from not properly checking for an exception condition that could result in...

EUVD-2025-33293

A race condition exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files. CrowdStrike released a security fix for this issue in Falcon sensor for Windows versions 7.24 and above and all Long Term Visibility...

[SECURITY] Fedora 42 Update: mod_http2-2.0.35-1.fc42

The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers...

EUVD-2024-54930

Malicious code in bioql PyPI...

EUVD-2025-31301

Malicious code in bioql PyPI...

EUVD-2025-25526

Malicious code in bioql PyPI...

EUVD-2025-27277

Malicious code in bioql PyPI...

CVE-2025-11230

Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests...

CVE-2025-36351

IBM License Metric Tool 9.2.0 through 9.2.40 could allow an authenticated user to bypass access controls in the REST API interface and perform unauthorized actions...

CVE-2025-36352

IBM License Metric Tool (ILMT) versions 9.2.0–9.2.40 are vulnerable to stored cross-site scripting (CXS) in the Web UI, exploitable by an authenticated user and potentially leading to credentials disclosure in a trusted session. The issue is tied to IBM’s advisory and public CVE-2025-36352 record...

Medium: cups

Issue Overview: OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, an unsafe deserialization and validation of printer attributes causes null dereference in the libcups library. This is a remote DoS vulnerability...