CVE-2025-22149 JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh

JWK Set JSON Web Key Set is a JWK and JWK Set Go implementation. Prior to 0.6.0, the project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or append. This is a security issue for use...

CVE-2025-22149 JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh

JWK Set JSON Web Key Set is a JWK and JWK Set Go implementation. Prior to 0.6.0, the project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or append. This is a security issue for use...

Covert Timing Channel

Overview Affected versions of this package are vulnerable to Covert Timing Channel through the decryption process. An attacker can decrypt messages or forge signatures by exchanging a large number of messages with the vulnerable service Marvin Attack. Workaround This vulnerability can be mitigate...

DEBIAN-CVE-2023-38037

ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file's permissions are defaulted to the user's current umask settings, meaning that it's possible for other users on the same system to read the contents of the temporary file. Attackers that ha...

CVE-2023-38037

ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file's permissions are defaulted to the user's current umask settings, meaning that it's possible for other users on the same system to read the contents of the temporary file. Attackers that ha...

PT-2025-2059 · Wander Chu · Springboot-Blog

Name of the Vulnerable Software and Affected Versions: wander-chu SpringBoot-Blog version 1.0 Description: A critical vulnerability has been found in the Admin Attachment Handler component, specifically affecting the upload function of the AttachtController.java file. The manipulation of the file...

PT-2025-2803 · Unknown · Neat Board Nfc

Name of the Vulnerable Software and Affected Versions: Neat Board NFC version 1.20240620.0015 Description: A Buffer Overflow issue exists, allowing physically proximate attackers to escalate privileges via a crafted payload to the password field. This enables local privilege escalation...

PT-2025-2058 · Wander Chu · Springboot-Blog

Name of the Vulnerable Software and Affected Versions: wander-chu SpringBoot-Blog version 1.0 Description: A critical vulnerability was found in the HTTP POST Request Handler component, specifically affecting the preHandle function of the BaseInterceptor.java file. This leads to improper access...

PT-2025-3842 · Code Projects · Code-Projects Admission Management System

Name of the Vulnerable Software and Affected Versions: code-projects Admission Management System version 1.0 Description: A critical issue has been found in the Login component of the system, specifically in the file index.php. The manipulation of the u id argument leads to SQL injection. This...

PT-2025-4383 · Jwk Set +1 · Jwk Set +1

Name of the Vulnerable Software and Affected Versions: JWK Set versions prior to 0.6.0 Description: The project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. However, the current behavior is to overwrite or append, which...

PT-2025-2065 · Unknown · Redaxo Cms

Name of the Vulnerable Software and Affected Versions: Redaxo CMS version 5.18.1 Description: A vulnerability was found in the Structure Management Page component of Redaxo CMS, affecting an unknown function of the file /index.php?page=structure&category id=1&article id=1&clang=1&function=edit...

PT-2025-3828 · Kaiyuantong · Kaiyuantong Ect Platform

Name of the Vulnerable Software and Affected Versions: KaiYuanTong ECT Platform versions up to 2.0.0 Description: A critical issue has been found in the HTTP POST Request Handler component of the affected software, specifically in the file /public/server/runCode.php. The manipulation of the code...

PT-2025-1936 · WordPress · Backlink Monitoring Manager

Name of the Vulnerable Software and Affected Versions: Backlink Monitoring Manager WordPress plugin versions 0.1.3 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitized and escaped before being outputted back in the...

Chromium: Monthly Vulnerability Updates

Palo Alto Networks incorporated the following Chromium security fixes into our products: https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop10.html https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop18.html Work around: No workaround or...

PT-2025-2048 · Unknown · Zerowdd Myblog

Name of the Vulnerable Software and Affected Versions: ZeroWdd myblog version 1.0 Description: A critical issue has been found in the unknown code of the file src/main/resources/mapper/BlogMapper.xml. The manipulation of the findBlogList and getTotalBlogs arguments leads to xml injection. The...

PT-2025-2051 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SEMCMS versions prior to 4.8 Description: A critical issue has been found in SEMCMS, affecting an unknown functionality of the SEMCMS Images.php file in the Image Library Management Page component. This issue leads to a SQL injection. The...

PT-2025-2046

Name of the Vulnerable Software and Affected Versions MicroWorld eScan Antivirus version 7.0.32 Description A critical issue affects some unknown functionality of the file /opt/MicroWorld/var/ of the component Installation Handler, leading to incorrect default permissions. The attack must be...

PT-2025-2965

Name of the Vulnerable Software and Affected Versions composio versions 0.5.40 and later Description The issue allows for command execution in composio openai, composio claude, and composio julep via the handle tool calls function. This is due to improper user input sanitization, leading to...

PT-2025-2052 · Sucms · Sucms

Name of the Vulnerable Software and Affected Versions: Sucms version 1.0 Description: A critical issue affects some unknown functionality of the file /admin/admin members.php?ac=search. The manipulation of the uid argument leads to SQL injection. The attack may be launched remotely. The exploit h...

PT-2025-1065 · Dell · Dell Vxrail

Name of the Vulnerable Software and Affected Versions: Dell VxRail versions 8.0.000 through 8.0.311 Description: The issue is related to the storage of critical information in plaintext, which could allow an attacker to expose protected information. A high-privileged attacker with local access...