XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}

Impact POST /wikis/wikiName executes a XAR import without performing any authentication or authorization checks, allowing an unauthenticated attacker to create or update documents in the target wiki Patches This vulnerability has been patched in XWiki 16.10.17, 17.4.9, 17.10.3, 18.0.1 and...

CVE-2025-64481 Open redirect endpoint in Datasette

Datasette is an open source multi-tool for exploring and publishing data. In versions 0.65.1 and below and 1.0a0 through 1.0a19, deployed instances of Datasette include an open redirect vulnerability. Hits to the path //example.com/foo/bar/ the trailing slash is required will redirect the user to...

CVE-2025-64481

CVE-2025-64481 affects Datasette, an open-source data exploration/publishing tool. The vulnerability is an open redirect in deployed instances of Datasette versions 0.65.1 and earlier, and 1.0a0 through 1.0a19, triggered by requests to a path containing double slashes (for example, //example.com/...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the rekey process. An attacker can disrupt critical security operations by sending unauthenticated requests to cancel root rekey and recovery rekey operations. This can result in denial o...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the rekey process. An attacker can disrupt critical security operations by sending unauthenticated requests to cancel root rekey and recovery rekey operations. This can result in denial o...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to a bypass of the rate limiter, by forging proxy headers. An attacker can send unlimited traffic to the site. Note: See this documentation, if the IP address of a remote proxy needs to be authorized. Workaroun...