CVE-2025-40934 XML-Sig prior to 0.68 for Perl improperly validates XML without signatures

XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. An attacker can remove the signature from the XML document to make it pass the verification check. XML-Sig is a Perl module to validate signatures on XML files. An unsigned XML file should retur...

KDE Krita 安全漏洞

KDE Krita is a digital painting and animation software from the KDE community. A security vulnerability exists in KDE Krita versions prior to 5.2.13, which stems from a heap buffer overflow that may result from loading a specially crafted TGA file...

Ray 跨站请求伪造漏洞

Ray is a unified framework for scaling AI and Python applications open-sourced by ray-project. A cross-site request forgery vulnerability exists in versions of Ray prior to 2.52.0, which stems from insufficient protection against browser-based attacks and could lead to remote code execution...

CVE-2025-55174

In KDE Skanpage before 25.08.0, an attempt at file overwrite can result in the contents of the new file at the beginning followed by the partial contents of the old file at the end, because of use of QIODevice::ReadWrite instead of QODevice::WriteOnly...

JLSEC-2025-237 In libarchive before 3.6.2, the software does not check for an error after calling calloc function...

In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the...

Synergetic Data Systems UnForm Server 安全漏洞

Synergetic Data Systems UnForm Server is a document management and print archiving server software from Synergetic Data Systems, USA. A security vulnerability exists in Synergetic Data Systems UnForm Server versions prior to 10.1.15, which stems from an unauthenticated file read and SMB coercion...

CVE-2025-60915

An issue in the size query parameter /views/file.py of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute a path traversal via a crafted request...

EUVD-2025-198515

Black Duck SCA versions prior to 2025.10.0 had user role permissions configured in an overly broad manner. Users with the scoped Project Manager user role with the Global User Read access permission enabled access to certain Project Administrator functionalities which should have be inaccessible...

PT-2025-51144

Name of the Vulnerable Software and Affected Versions Exim versions prior to 4.99.1 Description Exim software contains a flaw that allows for remote heap corruption. Further details about this issue will be disclosed on 2025-12-18. Recommendations Update to version 4.99.1 or later...

Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

...

Black Duck SCA 安全漏洞

Black Duck SCA is a software composition analysis tool from Black Duck USA. A security vulnerability exists in Black Duck SCA versions prior to 2025.10.0 that stems from an overly broad configuration of user role permissions, which could lead to unauthorized project configuration changes or acces...

MLX 代码问题漏洞

MLX is a machine learning framework open-sourced by ml-explore. A code issue vulnerability exists in MLX versions prior to 0.29.4 that stems from a segmentation error when loading a malicious GGUF file, which could cause the application to crash...

Wazuh 代码问题漏洞

Wazuh is a Wazuh open source application. It is used to collect, aggregate, index and analyze security data to help organizations detect intrusions, threats and behavioral anomalies. A code issue vulnerability exists in Wazuh versions 3.7.0 through prior to 4.12.0 that stems from the fimalert...

CVE-2025-60738

An issue in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before Logic Version v6.00 - 20250721 and before allows a remote attacker to execute arbitrary code via the ping.php component does not perform secure filtering on IP parameters...

CVE-2025-11963

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Saysis Computer Systems Trade Ltd. Co. StarCities allows Reflected XSS. This issue affects StarCities: before 1.1.61...

CVE-2024-7021

Inappropriate implementation in Autofill in Google Chrome on Windows prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

Astro 路径遍历漏洞

Astro is an Astro open source web framework for content-driven websites. A path traversal vulnerability exists in Astro versions prior to 5.15.8, which stems from inconsistent path normalization and could lead to bypassing authentication checks to access protected routes...

PYSEC-2025-253

Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code...

CVE-2025-58122 Insufficient permission validation when configuring notification parameters

Insufficient permission validation in Checkmk 2.4.0 before version 2.4.0p16 allows low-privileged users to modify notification parameters via the REST API, which could lead to unauthorized actions or information disclosure...

LibreNMS SQL注入漏洞

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of network environments, and automatic updates. An SQL injection vulnerability exists in LibreNMS versions prior to 25.11.0 that stems...