CVE-2025-66614

Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL...

CVE-2025-36019

IBM Concert 1.0.0 through 2.1.0 for Z hub framework is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2024-43178

IBM Concert 1.0.0 through 2.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2026-24733 Apache Tomcat: Security constraint bypass with HTTP/0.9

Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a specification inval...

Unauthenticated File Upload in Gogs

Security Advisory:Unauthenticated File Upload in Gogs Vulnerability Type: Unauthenticated File Upload Date: Aug 5, 2025 Discoverer: OpenAI Security Research Summary Gogs exposes unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled default, any...

GO-2026-4487 Mattermost Server allows an attacker to specify a full pathname of a log file in github.com/mattermost/mattermost-server

Mattermost Server allows an attacker to specify a full pathname of a log file in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

PYSEC-2026-113

Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file but not an IPC stream with pre-buffering enabled, if the IPC file contains data with variadic buffers such as Binary View and String...

CVE-2026-2548

A flaw has been found in WAYOS FBM-220G 24.10.19. This affects the function sub40F820 of the file rc. Executing a manipulation of the argument upnpwaniface/upnpssdpinterval/upnpmaxage can lead to command injection. The attack can be executed remotely. The vendor was contacted early about this...

CVE-2025-7706

CVE-2025-7706 describes a Missing Authentication for a Critical Function in Liderahenk from TUBITAK BILGEM STI, affecting versions 3.0.0–3.3.1 prior to 3.5.0. The issue enables Remote Code Inclusion due to lack of auth on a critical function. CVSSv3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N is 6.1 (M...

@0xcurvy/curvy-sdk (0.0.8-rc.1), @acyclic/keythereum (>=1.1.0, <=1.1.2) +456 more potentially affected by CVE-2026-4258 via sjcl (>=1.0.0, <=1.0.8)

sjcl NPM version =1.0.0, =1.1.0, =0.2.0, =0.4.0, =0.1.0, =0.0.1, =1.1.5, =9.0.7, =9.0.7, =11.5.2, =11.5.2, =1.0.1, =1.0.7 and more Source cves: CVE-2026-4258 Source advisory: SNYK:JS-SJCL-15369617...

@0x5e/react-native-alipay (>=0.2.2, <=0.2.7-beta.2), @10yun/cv-mobile-ui (0.3.20) +1794 more potentially affected by CVE-2026-4599 via jsrsasign (>=7.1.2, <=11.1.0)

jsrsasign NPM version =7.1.2, =0.2.2, =0.0.0-alpha.0, =0.7.6, =0.7.6, =0.0.83, =0.7.6, =0.7.6, =0.9.0, =0.7.6, =0.7.6, =0.7.6, =0.3.4, =0.3.4, =0.3.4, =0.8.0 and more Source cves: CVE-2026-4599 Source advisory: SNYK:JS-JSRSASIGN-15370939...

WordPress Gustavo theme <= 1.2.2 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Gustavo versions = 1.2.2...

WordPress StyleBidet plugin <= 1.0.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Abdulsamad Yusuf 0xVenus - Envorasec in WordPress Plugin StyleBidet versions = 1.0.0...

PT-2026-20264

Name of the Vulnerable Software and Affected Versions jizhicms version 2.5.6 Description The software contains a SQL Injection issue in the 'Article/deleteAll' and 'Extmolds/deleteAll' functionalities. The issue is triggered through the data parameter. Recommendations Update to a newer version th...

IBM DB2 Merge Backup 安全漏洞

IBM DB2 Merge Backup is a database-assisted backup tool developed by IBM. Version 12.1.0.0 of IBM DB2 Merge Backup for Linux, UNIX, and Windows contains a security vulnerability. This vulnerability stems from improper cleanup of resources in the buffer, which could allow attackers to access...

PT-2026-20270

Name of the Vulnerable Software and Affected Versions EKA Software Real Estate Script versions through 17022026 Description The software contains an Improper Neutralization of Input During Web Page Generation issue, also known as Cross-Site Scripting XSS. This allows for the execution of maliciou...

📄 PaperCut MF/NG 25.0.5 Authentication Bypass / Remote Code Execution

A critical security vulnerability was discovered in version 25.0.5 of PaperCut MF/NG that allows attackers to bypass authentication and execute remote commands on the target system without requiring any credentials...

PT-2026-20247

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 2.1.0 Description IBM Concert versions 1.0.0 through 2.1.0 are susceptible to a server-side request forgery SSRF condition. A successful exploit could allow an authenticated attacker to dispatch unauthorized...

WordPress plugin Forminator Forms – Contact Form, Payment Form & Custom Form Builder 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

IBM Security QRadar EDR 加密问题漏洞

IBM Security QRadar EDR is a terminal detection and response software developed by the American multinational company IBM. There are vulnerabilities related to encryption in versions 3.12 to 3.12.23 of IBM Security QRadar EDR. These vulnerabilities stem from the use of encryption algorithms that...