CVE-2025-56572

CVE-2025-56572 affects finance.js v4.1.0 and describes a Denial of Service via the seekZero() parameter or IRR depth parameter. Root cause is improper handling of recursion/iteration limits, leading to excessive CPU usage and potential application stalls or crashes. Reported in multiple sources (...

CVE-2025-48006

Improper restriction of XML external entity reference issue exists in DataSpider Servista 4.4 and earlier. If a specially crafted request is processed, arbitrary files on the file system where the server application for the product is installed may be read, or a denial-of-service DoS condition ma...

TawkTo Widget 安全漏洞

TawkTo Widget is a widget design program from TawkTo, Inc. A security vulnerability exists in version v4 of TawkTo Widget that originates from unvalidated input and could lead to a reflected cross-site scripting attack...

PT-2025-39845

Name of the Vulnerable Software and Affected Versions tawk.to chatbox widget version 4 Description A reflected cross-site scripting XSS issue exists in tawk.to chatbox widget version 4. This allows attackers to execute arbitrary Javascript in the context of a user’s browser by injecting a crafted...

CVE-2025-57483

A reflected cross-site scripting XSS vulnerability in tawk.to chatbox widget v4 allows attackers to execute arbitrary Javascript in the context of the user's browser via injecting a crafted payload into the vulnerable parameter...

PT-2025-39925

Name of the Vulnerable Software and Affected Versions AgentAPI versions 0.3.3 and below Description AgentAPI, an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex, is susceptible to a client-side DNS rebinding attack when hosted over plain HTTP on localhost. An attacker can gain acce...

CVE-2025-57483

A reflected cross-site scripting XSS vulnerability in tawk.to chatbox widget v4 allows attackers to execute arbitrary Javascript in the context of the user's browser via injecting a crafted payload into the vulnerable parameter...

CVE-2025-60125

Insertion of Sensitive Information Into Sent Data vulnerability in themelooks FoodBook foodbook allows Retrieve Embedded Sensitive Data.This issue affects FoodBook: from n/a through = 4.7.6...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-pycares (SUSE-SU-2025:03354-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:03354-1 advisory. Update to version 4.10.0 jscPED-13442: - CVE-2025-48945: Fixed use-after-free vulnerability may have led...

CVE-2025-59842

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.8, links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener...

CVE-2025-59842 JupyterLab LaTeX typesetter links did not enforce `noopener` attribute

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.8, links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener...

CVE-2025-11012

A vulnerability was determined in BehaviorTree up to 4.7.0. This affects the function ParseScript of the file /src/scriptparser.cpp of the component Diagnostic Message Handler. Executing manipulation of the argument errormsgsbuffer can lead to stack-based buffer overflow. The attack can only be...

Malicious code in html-webpack-plugin-4 (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-60127

CopySafe Web Protection (Copy Protect Images) is listed as vulnerable under CVE-2025-60127 due to a Missing Authorization issue. The problem arises from incorrectly configured access control security levels, enabling unauthorized actions within the affected product. The vulnerability is associate...

CVE-2025-10173

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized access due to an incorrect capability check on the postsave function in all versions up to, and including, 4.8.3. This makes it possible for authenticated...

WordPress plugin CopySafe Web Protection 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

SUSE-SU-2025:03354-1 Security update for python-pycares

This update for python-pycares fixes the following issues: Update to version 4.10.0 jscPED-13442: - CVE-2025-48945: Fixed use-after-free vulnerability may have led to a crash bsc1244691...

Security Bulletin: Multiple vulnerabilities in IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Manager (CVE-2025-50106, CVE-2025-30749, CVE-2025-30761, CVE-2025-30754).

Summary Multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 17, used by IBM Tivoli Network Manager IP Edition v4.2 core components. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products|...

RHEL 8 : Red Hat Product OCP Tools 4.14 OpenShift Jenkins (RHSA-2025:16461)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:16461 advisory. Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cron...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.17 ztp-site-generate container

An update for ztp-site-generate is available for Red Hat OpenShift Container Platform 4.17. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the ztp-site-generate...