CVE-2024-47081

Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be...

CVE-2025-49136 listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the env and expandenv template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-use...

Improper Authorization

Overview accelbyte-py-sdk is an AccelByte Python SDK Affected versions of this package are vulnerable to Improper Authorization via the resolve function in the protohttprequest.py, which accepts COOKIEAUTH and bypasses additional Basic or Bearer auth requirements. Remediation Upgrade...

VulnCheck KEV: CVE-2024-32870

Combodo iTop is a simple, web based IT Service Management tool. Server, OS, DBMS, PHP, and iTop info name, version and parameters can be read by anyone having access to iTop URI. This issue has been patched in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. There are no...

GHSA-C42H-56WX-H85Q laravel-auth0 SDK Deserialization of Untrusted Data vulnerability

Overview The laravel-auth0 SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Am I Affected?...

CVE-2025-5714

A vulnerability was found in SoluçõesCoop iSoluçõesWEB up to 20250516. It has been classified as problematic. This affects an unknown part of the file /sys/up.upload.php of the component Profile Information Update. The manipulation of the argument nomeArquivo leads to path traversal. It is possib...

CVE-2025-5714 SoluçõesCoop iSoluçõesWEB Profile Information Update up.upload.php path traversal

A vulnerability was found in SoluçõesCoop iSoluçõesWEB up to 20250516. It has been classified as problematic. This affects an unknown part of the file /sys/up.upload.php of the component Profile Information Update. The manipulation of the argument nomeArquivo leads to path traversal. It is possib...

Python Library jupyter_core < 5.8.0 Uncontrolled Search Path

The detected version of the Python package, jupytercore, is prior to 5.8.0. It is, therefore, affected by a vulnerability, as explained in the GHSA-33p9-3p43-82vq advisory. Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version...

[SECURITY] [DLA 4207-1] edk2 security update

Debian LTS Advisory DLA-4207-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany June 05, 2025 https://wiki.debian.org/LTS Package : edk2 Version : 2020.11-2+deb11u3 CVE ID : CVE-2021-28216 CVE-2021-38575 CVE-2021-38576 CVE-2021-38578 CVE-2022-36763 CVE-2022-36764...

GHSA-862M-5253-832R Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data

Overview The Auth0 Wordpress plugin contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Am I...

GHSA-V9M8-9XXP-Q492 Auth0-PHP SDK Deserialization of Untrusted Data vulnerability

Overview The Auth0 PHP SDK contains a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Am I Affected? You are...

WordPress Icegram Collect – Easy Form, Lead Collection and Subscription plugin <= 1.3.18 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by ch4r0n in WordPress Plugin Icegram Collect versions = 1.3.18...

[ASA-202506-1] roundcubemail: arbitrary code execution

Arch Linux Security Advisory ASA-202506-1 ========================================= Severity: Critical Date : 2025-06-04 CVE-ID : CVE-2025-49113 Package : roundcubemail Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2891 Summary ======= The package...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload through a manipulated API request. An attacker can upload unauthorized files by crafting a request that bypasses the configured file extension checks. Remediation Upgrade Umbraco.Cms.Core to version 15.4.2,...

Incorrect Implementation of Authentication Algorithm

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm. due to the improper invalidation of personal access tokens. An attacker can maintain access...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to improper enforcement of access control restrictions for System Manager roles. An attacker can gain unauthorized access via direct API requests to team endpoints and perform actions reserved for System...

CVE-2025-30167 Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared %PROGRAMDATA% directory is searched for configuration files SYSTEMCONFIGPATH and SYSTEMJUPYTERPATH, which may allow users to create configuration...

CVE-2025-30167 Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared %PROGRAMDATA% directory is searched for configuration files SYSTEMCONFIGPATH and SYSTEMJUPYTERPATH, which may allow users to create configuration...

CVE-2025-5498 slackero phpwcms Custom Source Tab cnt21.readform.inc.php is_file deserialization

A vulnerability was found in slackero phpwcms up to 1.9.45/1.10.8. It has been rated as critical. This issue affects the function filegetcontents/isfile of the file include/inclib/content/cnt21.readform.inc.php of the component Custom Source Tab. The manipulation of the argument cpagecustom leads...

Security Bulletin: IBM Engineering Systems Design Rhapsody was affected by CVE-2024-38081

Summary IBM Engineering Systems Design Rhapsody was affected by Microsoft .NET privilege escalation. Risk was signaficantly low. We have upgraded our Build Environment to resolve this vulnerability. Vulnerability Details CVEID:CVE-2024-38081 DESCRIPTION:.NET, .NET Framework, and Visual Studio...