Cherry Studio operating system command injection vulnerability

Cherry Studio is a multi-model AI assistant from China Thousand Comets Cherry Studio. An OS command injection vulnerability exists in Cherry Studio versions 1.2.5 through 1.5.1, which stems from an OS command injection when connecting to a malicious MCP server...

CVE-2025-36000 IBM WebSphere Application Server Liberty cross-site scripting

IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure with...

CVE-2025-36124 IBM WebSphere Application Server Liberty bypass security

IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 could allow a remote attacker to bypass security restrictions caused by a failure to honor JMS messaging configuration...

CVE-2024-41979

CVE-2024-41979 affects Siemens SmartClient modules Opcenter QL Home, SOA Audit, and SOA Cockpit (versions 13.2 through 2505). Root cause: the server does not enforce mandatory authorization on some functionality levels, allowing an authenticated attacker to gain complete access to the application...

PT-2025-32879

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server Liberty versions 17.0.0.3 through 25.0.0.8 Description: IBM WebSphere Application Server Liberty may allow a remote attacker to bypass security restrictions due to a failure to honor JMS messaging configuratio...

Siemens’ various products have security vulnerabilities

Siemens SmartClient modules Opcenter QL Home is a client module from Siemens Germany. A security vulnerability exists in various Siemens products, which stems from mishandling of errors and could lead to the exposure of system applications. The following products and versions are affected:...

VulnCheck KEV: CVE-2023-37941

If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by t...

SUSE CVE-2025-54999

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, when using OpenBao's userpass auth method, user enumeration was possible due to timing difference between non-existent users an...

BIT-LIBPHP-2024-8926 PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows...

Duplicate Advisory: Keras safe mode bypass vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c9rc-mg46-23w3. This link is maintained to preserve external references. Original Description A safe mode bypass vulnerability in the Model.loadmodel method in Keras versions 3.0.0 through 3.10.0 allows an...

UBUNTU-CVE-2025-8747

A safe mode bypass vulnerability in the Model.loadmodel method in Keras versions 3.0.0 through 3.10.0 allows an attacker to achieve arbitrary code execution by convincing a user to load a specially crafted .keras model archive...

CVE-2025-55000

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected...

Linux Distros Unpatched Vulnerability : CVE-2024-31309

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2...

Linux Distros Unpatched Vulnerability : CVE-2025-52434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Red Hat Enterprise Linux - tomcat: Apache Tomcat denial of service Ubuntu Linux - Concurrent Execution using Shared Resource with Improper Synchronization 'Race...

CBL Mariner 2.0 Security Update: mysql (CVE-2025-53023)

The version of mysql installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-53023 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Replication. Supported versions...

Linux Distros Unpatched Vulnerability : CVE-2024-36587

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insecure permissions in DNSCrypt-proxy v2.0.0alpha9 to v2.1.5 allows non-privileged attackers to escalate privileges to root via overwriting the binary...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +18 more potentially affected by CVE-2025-54793 via astro (>=5.2.1, <=5.12.6)

astro NPM version =5.2.1, =0.0.1, =1.0.0, =1.25.426-4, =0.6.2, =0.0.0-dev-20250414184926, =0.0.1, =0.0.1, =2.1.22, =1.0.3, =0.1.0, =0.3.19, =0.2.1, =0.4.0 and more Source cves: CVE-2025-54793 Source advisory: OSV:GHSA-CQ8C-XV66-36GW...

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.25. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

...

LibreChat authorization issue vulnerability

LibreChat is an enhanced ChatGPT clone by Danny Avila Personal Developer. An authorization issue vulnerability exists in LibreChat versions 0.0.6 through 0.7.7-rc1, which stems from a test endpoint exposure that could lead to the disclosure of arbitrary user chat logs...

claude-agents-md (>=1.8.0, <=1.8.5), claude-yolo (>=1.4.0, <=1.7.0) potentially affected by CVE-2025-54794 via @anthropic-ai/claude-code (>=0.2.14, <=0.2.35)

@anthropic-ai/claude-code NPM version =0.2.14, =1.8.0, =1.4.0, =1.7.0 Source cves: CVE-2025-54794 Source advisory: OSV:GHSA-PMW4-PWVC-3HX2...