2753 matches found
EUVD-2023-35199
Malicious code in bioql PyPI...
EUVD-2022-5643
Malicious code in bioql PyPI...
EUVD-2023-44771
Malicious code in bioql PyPI...
EUVD-2022-1175
Malicious code in bioql PyPI...
CVE-2025-61589 Cursor: Potential Information Leakage via Mermaid Diagram
Cursor is a code editor built for programming with AI. In versions 1.6 and below, Mermaid a to render diagrams allows embedding images which then get rendered by Cursor in the chat box. An attacker can use this to exfiltrate sensitive information to a third-party attacker controlled server throug...
CVE-2025-3193
The CVE-2025-3193 entry concerns algoliasearch-helper versions 2.0.0-rc1 through 3.11.2 (and earlier) with a Prototype Pollution in the _merge() function of merge.js. The underlying issue allows modification of constructor.prototype and, in an extreme edge-case where the resulting error is caught...
NetApp StorageGRID 安全漏洞
NetApp StorageGRID is a suite of object storage solutions from Network Appliance NetApp. A security vulnerability exists in NetApp StorageGRID versions prior to 11.8.0.15 and prior to 11.9.0.8, which stems from improper privilege management and could result in elevated privileges...
Security Bulletin: Resource Exhaustion and Memory Leak in Multer Due to Improper Stream Handling (Fixed in 2.0.0), affects watsonx.data
Summary Multer is a node.js middleware for handling multipart/form-data. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal busboy stream is not closed, violating Node.js...
Coder 代码问题漏洞
Coder is an application from Coder Inc. that allows for the setup of development environments in public or private cloud infrastructures. A code issue vulnerability exists in Coder versions 2.24.3 and earlier and 2.25.0 through 2.25.1, which stems from mishandling of sessions and could lead to...
CVE-2025-58372 Roo Code: Potential Remote Code Execution via .code-workspace
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a vulnerability where certain VS Code workspace configuration files .code-workspace are not protected in the same way as the .vscode folder. If the agent was configured to auto-appro...
PT-2025-35862
Name of the Vulnerable Software and Affected Versions: Markdownify versions prior to 0.0.2 Description: Markdownify is a Model Context Protocol server for converting content to Markdown. Versions prior to 0.0.2 contain a command injection issue, caused by the unsanitized use of input parameters...
LimonDesk 跨站脚本漏洞
LimonDesk is a real-time chat, work order ticketing, and other ransomware from LimonDesk, a Turkish company. A cross-site scripting vulnerability exists in LimonDesk versions prior to s1.02.14 through v1.ylabel17, which stems from improper input neutralization during web page generation and can...
Linux Distros Unpatched Vulnerability : CVE-2025-24814
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Core creation allows users to replace trusted configset files with arbitrary configuration Solr instances that 1 use the FileSystemConfigSetService component th...
Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.0.1.8)
The version of AOS installed on the remote host is prior to 7.0.1.8. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.0.1.8 advisory. - setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path...
n8n 跨站脚本漏洞
n8n is a scalable workflow automation tool from the n8n open source. A cross-site scripting vulnerability exists in n8n versions prior to 1.77.0 through 1.98.2, which stems from the presence of stored cross-site scripting in the HTML form element of the Form Trigger node, which could lead to...
Apache Tomcat 11.0.0.M1 < 11.0.10
The version of Tomcat installed on the remote host is prior to 11.0.10. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat11.0.10security-11 advisory. - Tomcat's HTTP/2 implementation was vulnerable to the made you reset attack. The denial of service typically...
CVE-2025-52931 Unexpected input to Update Channel Subscription endpoint causes DoS in Mattermost Confluence Plugin
Mattermost Confluence Plugin version 1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to update channel subscription endpoint with an invalid request body...
BIT-LIBPHP-2021-21706 ZipArchive::extractTo may extract outside of destination dir
In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS...
BIT-LIBPHP-2020-7070 PHP parses encoded cookie names so malicious `__Host-` cookies can be sent
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like Host confused with cookies that decode to such prefix, thus leading to an attacker being...
