CVE-1999-0526

An X server's access control is disabled e.g. through an "xhost +" command and allows anyone to connect to the server...

CVE-1999-0118

AIX infod allows local users to gain root access through an X display...

CVE-1999-0688

Buffer overflows in HP Software Distributor SD for HPUX 10.x and 11.x...

CVE-1999-0413

A buffer overflow in the SGI X server allows local users to gain root access through the X server font path...

CVE-2019-16725

In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates...

CVE-2006-3413

The privoxy configuration file in Tor before 0.1.1.20, when run on Apple OS X, logs all data via the "logfile", which allows attackers to obtain potentially sensitive information...

CVE-2025-13694 AA Block country <= 1.0.1 - Unauthenticated IP Address Spoofing via X-Forwarded-For Header

The AA Block Country plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.0.1. This is due to the plugin trusting user-supplied headers such as HTTPXFORWARDEDFOR to determine the client's IP address without proper validation or considering if the server is...

CVE-2025-53605 vulnerabilities

Vulnerabilities for packages: parseable, rust-analyzer, yara-x, qdrant...

CVE-2025-4574 vulnerabilities

Vulnerabilities for packages: fd, rust-analyzer, yara-x, samply, pixi, ruff, starship, cargo-audit, yazi, oxipng, wadm, wasmcloud, lychee, zed, cargo-c, nushell, oranda, deno...

CVE-2025-53605 vulnerabilities

Vulnerabilities for packages: parseable, ztunnel-fips, ztunnel, qdrant, rust-analyzer, yara-x...

CVE-2025-4574 vulnerabilities

Vulnerabilities for packages: pixi, zed, deno, ztunnel-fips, ztunnel, lychee, starship, wadm, wasmcloud, rust-analyzer, oxipng, oranda, cargo-c, cargo-audit, fd, samply, ruff, nushell, yazi, yara-x...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000403)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000403 advisory. The Linux kernel 4.9.x before 4.9.233, 4.14.x before 4.14.194, and 4.19.x before 4.19.140 has a use-after- free because skcd-norefcnt was not considered during a...

Symfony Conflicting Headers Information Disclosure

The remote web application is using Symfony, a PHP framework. It is affected by an information disclosure vulnerability arising from conflicting proxy headers. When both 'Forwarded' and 'X-Forwarded-' headers are present in a request, a misconfiguration in Symfony's trusted proxy settings can...

Grok Is Pushing AI ‘Undressing’ Mainstream

Paid tools that “strip” clothes from photos have been available on the darker corners of the internet for years. Elon Musk’s X is now removing barriers to entry—and making the results public...

MAL-2026-95 Malicious code in x-clients-features (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 419d018f4db7282c5ea456563704c47d16246b1836a54f60696da59cb05cad04 The package x-clients-features was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview x-clients-features is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

EUVD-2026-1106

Malicious code in x-clients-features npm...

Malicious code in x-clients-features (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 419d018f4db7282c5ea456563704c47d16246b1836a54f60696da59cb05cad04 The package x-clients-features was found to contain malicious code. Source: ghsa-malware...

CVE-2025-69197 Pterodactyl TOTPs can be reused during validity window

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled are prompted to enter a token during sign-in, and afterward it is not sufficiently marked as used in the system. This...

SUSE CVE-2025-66508

1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.14 and below use Gin's default configuration which trusts all IP addresses as proxies TrustedProxies = 0.0.0.0/0, allowing any client to spoof the X-Forwarded-For header. Since all IP-based access controls...