CVE-2025-29928

authentik is an open-source identity provider. Prior to versions 2024.12.4 and 2025.2.3, when authentik was configured to use the database for session storage which is a non-default setting, deleting sessions via the Web Interface or the API would not revoke the session and the session holder wou...

CVE-2025-29928

authentik is an open-source identity provider. Prior to versions 2024.12.4 and 2025.2.3, when authentik was configured to use the database for session storage which is a non-default setting, deleting sessions via the Web Interface or the API would not revoke the session and the session holder wou...

CVE-2025-2859

An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the device via web, depending on the privileges obtained by the user...

CVE-2025-29928: Session Fixation

authentik is an open-source identity provider. Prior to versions 2024.12.4 and 2025.2.3, when authentik was configured to use the database for session storage which is a non-default setting, deleting sessions via the Web Interface or the API would not revoke the session and the session holder wou...

CVE-2025-27609: Improper Neutralization of Input During Web Page Generation

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a request that, once transmitted to a victim's Icinga Web, allows to embed arbitrary Javascript into it and to act on...

IBM Jazz for Service Management XSS

The vulnerability of the web interface of the IBM Jazz for Service Management platform management and automation processes is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remote...

TOTOLINK X5000R Router setWiFiScheduleCfg() Arbitrary Command Execution

The vulnerability of the setWiFiScheduleCfg function in the web/cgi-bin/cstecgi.cgi script of the TOTOLINK X5000R router’s microprogramming system is related to the failure to take measures to neutralize special elements used in the operating system’s processing of the week parameter. Exploiting...

(0Day) BEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of BEC Technologies routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the web-based user interface. The issue results from storing credentials in...

(0Day) BEC Technologies Multiple Routers Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of BEC Technologies routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web-based user interface. The issue results from the lack of authentication...

Excessive Data Query Operations in a Large Data Table

Overview aim is a super-easy way to record, search and compare AI experiments. Affected versions of this package are vulnerable to Excessive Data Query Operations in a Large Data Table through the tracking and simultaneous querying of a large number of Text objects via the web API. An attacker ca...

CVE-2025-1385

When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits...

UBUNTU-CVE-2025-1385

When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits...

Stable Diffusion web UI cross-site scripting vulnerability

Stable Diffusion web UI is a web interface by the individual developer of AUTOMATIC1111. A cross-site scripting vulnerability exists in the Stable Diffusion web UI that originates from an HTML file upload and could lead to a stored cross-site scripting attack...

PT-2025-12073

Name of the Vulnerable Software and Affected Versions eosphoros-ai/db-gpt version v0.6.0 Description The issue allows execution of arbitrary SQL queries without access control through the web API endpoint POST /api/v1/editor/sql/run. This can be exploited to perform Arbitrary File Write using...

LoLLMs Web UI resource management error vulnerability

LoLLMs Web UI is a web user interface for large languages and multimodal systems by the individual developer Saifeddine ALOUI. A resource management error vulnerability exists in LoLLMs Web UI version v13, which stems from a denial-of-service attack that could result from improper handling of...

Aim security vulnerabilities

Aim is an easy-to-use and high-performance open source experiment tracker from Aim Open Source USA. A security vulnerability exists in Aim version 3.25.0 that originates when tracking a large number of Text objects and querying them simultaneously via the Web API, which can lead to server...

Gradio security vulnerabilities

Gradio, an open source Python library from Gradio Open Source, is a method for demonstrating machine learning models through a friendly web interface. A security vulnerability exists in Gradio that stems from an open redirect that could cause users to be redirected to a malicious website...

Number withdrawal

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI Open Source. This CVE number has been withdrawn...

Stable Diffusion web UI security vulnerability

Stable Diffusion web UI is a web interface for AUTOMATIC1111 individual developers. A security vulnerability exists in the Stable Diffusion web UI that originates from a specially crafted request and could lead to a local file inclusion attack...

Serge cross-site scripting vulnerability

Serge is a Serge open source web interface for chatting via llama.cpp. A cross-site scripting vulnerability exists in Serge version 0.9.0, which stems from improper input neutralization during web page generation and could lead to a stored cross-site scripting attack...