CVE-2025-57327

spmrc is a package that provides the rc manager for spm. A Prototype Pollution vulnerability in the set and config function of spmrc version 1.2.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service DoS as the minimum...

CVE-2025-57349

The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollution due to improper handling of message key paths in versions prior to 2.3.0. The flaw arises when processing nested message keys containing special character...

CVE-2025-9844

CVE-2025-9844 (Salesforce CLI on Windows) Affected software: Salesforce CLI (Salesforce) on Windows.Root cause: Uncontrolled Search Path Element that can lead to replacement of a trusted executable.Impact: Potential code execution through replacing a trusted executable; CVSS v3.1 base score 8.8 (...

CVE-2025-59583

CVE-2025-59583 affects the Penci Filter Everything WordPress plugin (PenciFilter Everything, penci-filter-everything) with a DOM-based XSS flaw caused by improper input neutralization during web page generation in versions

WordPress Colibri Page Builder Plugin < 1.0.334 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by savphill in WordPress Plugin Colibri Page Builder versions 1.0.334...

CVE-2025-0875 IDOR in Proliz Software's OBS

Authorization Bypass Through User-Controlled Key vulnerability in PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS Student Affairs Information System allows Parameter Injection. This issue affects OBS Student Affairs Information System: before v26.0328...

CVE-2025-59712

Snipe-IT before 8.1.18 allows XSS...

Grouper 安全漏洞

Grouper is an Internet2 open source enterprise access management system designed for highly distributed administrative environments and heterogeneous information technology environments common to colleges and universities. A security vulnerability exists in Grouper versions 5.17.1 through prior t...

CVE-2025-53605 affecting package kata-containers for versions less than 3.19.1.kata2-1

CVE-2025-53605 affecting package kata-containers for versions less than 3.19.1.kata2-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-13151 SQLi in ESBI Informatics's Auto Service Software

CWE - 89 - Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ESBI Information and Telecommunication Industry and Trade Limited Company Auto Service Software allows SQL Injection. This issue affects Auto Service Software: before v.2025.10.01...

CVE-2025-5305 Password Reset with Code < 0.0.17 - Insecure Password Reset Code Creation

The Password Reset with Code for WordPress REST API WordPress plugin before 0.0.17 does not use cryptographically sound algorithms to generate OTP codes, potentially leading to account takeovers...

CVE-2025-58431

CVE-2025-58431 affects ZimaOS (fork of CasaOS) prior to version 1.4.2. The /v2_1/files/file/download API endpoint allows unauthorized local users with localhost access to read local files, with reads executed as ROOT. Multiple sources (Red Hat, CVE records, CVE lists, and vulnerability databases)...

CVE-2025-59397

Open Web Analytics OWA before 1.8.1 allows owadb.php vvalue SQL injection...

CISA Thorium 安全漏洞

CISA Thorium is a highly scalable distributed malware analysis and data generation framework from the U.S. Cybersecurity and Infrastructure Security Administration CISA government division. A security vulnerability exists in CISA Thorium versions prior to 1.1.2 that stems from unvalidated TLS...

CVE-2025-8276 HTML Injection in Patika Global Technologies' HumanSuite

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting', Improper Encoding or Escaping of Output, Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Patika Global Technologies HumanSuite allows...

UBUNTU-CVE-2025-10530

Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability affects Firefox 143 and Thunderbird 143...

CVE-2025-55834

A Cross Site Scripting vulnerability in JeeWMS v.3.7 and before allows a remote attacker to obtain sensitive information via the logController.do component...

PT-2025-38067

Name of the Vulnerable Software and Affected Versions: CYRISMA Agent versions prior to 444 Description: A DLL hijacking vulnerability allows local users to escalate privileges and execute arbitrary code via multiple DLLs. Recommendations: Update CYRISMA Agent to version 444 or later...

BGS Interactive SINAV.LINK Exam Result Module SQL注入漏洞

BGS Interactive SINAV.LINK Exam Result Module is a system component of BGS Interactive that manages exam results. A SQL injection vulnerability exists in BGS Interactive SINAV.LINK Exam Result Module versions prior to 1.2, which stems from improper neutralization of a special element and could le...

CVE-2025-59375

Summary: CVE-2025-59375 affects libexpat in Expat before 2.7.2. A small XML document can trigger large dynamic memory allocations, per multiple security advisories. Affected software: libexpat (Expat) prior to version 2.7.2. Impact (as stated): Attackers may cause large memory allocations; impact...