12893 matches found
PT-2025-13623
Name of the Vulnerable Software and Affected Versions PyTorch version 2.6.0+cu124 Description A problematic issue has been found, affecting the function torch.mkldnn max pool2d, which can lead to denial of service. The manipulation requires a local approach. Recommendations For PyTorch version...
PT-2025-13631 · Trendnet · Trendnet Tew-410Apb
Name of the Vulnerable Software and Affected Versions: TRENDnet TEW-410APB version 1.3.06b Description: A vulnerability was found in the HTTP Request Handler component, specifically affecting the function sub 4019A0 of the file /usr/sbin/httpd. This issue leads to a null pointer dereference. The...
CVE-2025-30211 KEX init error results with excessive memory usage
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names 64 characters provided in K...
CVE-2025-30211 KEX init error results with excessive memory usage
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names 64 characters provided in K...
CVE-2025-30371 Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint
Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potential...
CVE-2025-30371 Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint
Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potential...
github.com/jaredallard/archives Has Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact A malicious user could feed a specially crafted archive to this library causing RCE, modification of files or other bad things in the context of whatever user is running this library as, through the program that imports it. The severity highly depends on the user's permissions and...
BIT-DISCOURSE-2025-24972 Discourse may bypass user preference when adding users to chat groups
Discourse is an open-source discussion platform. Prior to versions 3.3.4 on the stable branch and 3.4.0.beta5 on the beta branch, in specific circumstances, users could be added to group direct messages despite disabling direct messaging in their preferences. Versions 3.3.4 and 3.4.0.beta5 contai...
CVE-2025-27793
A Cross-site scripting flaw was found in the Vega library for Node.js. In affected versions, users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs unless the library was used with the vega-interpreter. Mitigation As a workaround, use vega with...
PT-2025-20570
Name of the Vulnerable Software and Affected Versions Tenda FH451 version 1.0.0.9 Description The issue is related to a stack overflow in the P2pListFilter function. Recommendations For Tenda FH451 version 1.0.0.9, consider disabling the P2pListFilter function as a temporary workaround until a...
PT-2025-13543 · Ericsson +6 · Erlang/Otp +6
Name of the Vulnerable Software and Affected Versions: Erlang/OTP versions prior to 27.3.1 Erlang/OTP versions prior to 26.2.5.10 Erlang/OTP versions prior to 25.3.2.19 Description: A maliciously formed KEX init message can result in high memory usage due to the implementation not verifying RFC...
PT-2025-13567
Name of the Vulnerable Software and Affected Versions HDF5 versions up to 1.14.6 Description A problematic issue was found in HDF5, affecting the H5HL fl deserialize function in the file src/H5HLcache.c. The manipulation of the free block argument leads to a heap-based buffer overflow. This issue...
CVE-2025-30222
Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows with CMD. This impact users of Shescape on Windows that explicitly configure shell: 'cmd.exe' or shell: true using any of...
CVE-2023-52990
Removed by vendor...
CVE-2025-27793
Vega (visualization grammar) and the related Vega-lite JSON workflow are affected by CVE-2025-27793. In Vega versions prior to 5.32.0 (and vega-functions prior to 5.17.0), processing Vega/Vega-lite JSON could cause execution of unintended JavaScript unless the library is used with the vega-interp...
SUSE CVE-2025-30164
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user or one that is able to authenticate, allows to...
PT-2025-13241 · Code Projects · Payroll Management System
Name of the Vulnerable Software and Affected Versions: code-projects Payroll Management System version 1.0 Description: A critical issue was found in the Payroll Management System. The problem affects an unknown functionality of the file update employee.php. The manipulation of the emp type...
PT-2025-13389 · Ibm · Ibm Cloud Pak System
Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak System versions 2.3.3.0 through 2.3.4.1 Description: The issue could allow a user with access to the network to obtain sensitive information from CLI arguments. Recommendations: For versions 2.3.3.0 through 2.3.4.1, consider...
PT-2025-13055 · Wip · Woocarousel Lite
Name of the Vulnerable Software and Affected Versions: WIP WooCarousel Lite versions 1.1.7 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can execute malicious scripts on the victim's browser,...