Weblate is a web based localization tool. Versions lower than 5.13.1 contain a vulnerability that causes long session expiry during the second factor verification. The long session expiry could be used to circumvent rate limiting of the…

▾ Sunlitweblate · weblateEPSS 0.30%via NVD

CVE-2025-9566High· 8.1

1y ago

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In…

▾ TwilightRed Hat · podmanEPSS 1.2%via NVD

CVE-2025-55190High· 8.8PoC

1y ago

github.com/argoproj/argo-cd: Project API Token Exposes Repository Credentials (CVE-2025-55190)

An information leak was discovered in how Argo CD handles API tokens. The project details API endpoint could provide unintentional access to sensitive repository credentials.

▾ MidnightRed Hat · Red Hat OpenShift GitOps 1.17EPSS 5.7%via CSAF

CVE-2025-6984High· 7.5

1y ago

langchain-community: Langchain-community insecure XML parsing (CVE-2025-6984)

An XML External Entity flaw has been discovered in the langchain-community python package. The EverNoteLoader component has an insecure use of the `etree.iterparse()` function which does not disable external entity references. This can lea…

▾ TwilightRed Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 8EPSS 1.6%via CSAF

CVE-2025-58367Critical

1y ago

DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more

▾ Midnightdeepdiff · deepdiffEPSS 1.2%via OSV

CVE-2025-57808High· 8.1PoC

1y ago

ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header

▾ Midnightesphome · esphomeEPSS 1.5%via OSV

CVE-2025-58161Low

1y ago

MobSF Path Traversal in GET /download/<filename> using absolute filenames

▾ Sunlitmobsf · mobsfEPSS 0.83%via OSV

CVE-2025-58162Medium· 6.5

1y ago

MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction

▾ Sunlitmobsf · mobsfEPSS 0.59%via OSV

CVE-2025-58160None

1y ago

Logging user input may result in poisoning logs with ANSI escape sequences

▾ Sunlittracing-subscriber · tracing-subscriberEPSS 0.34%via OSV

CVE-2025-47909Medium

1y ago

github.com/gorilla/csrf improperly validates TrustedOrigins allowing CSRF attacks

▾ Sunlitgorilla · github.com/gorilla/csrfEPSS 0.17%via OSV

CVE-2023-41471High· 7.8

1y ago

Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to t…

Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS function. NOTE: this is disputed because WEEKEND-PLANS is accessible only to actors…

▾ Twilightcopyparty · copypartyEPSS 0.27%via OSV

Tagged “osv”

Neo4j Cypher MCP server is vulnerable to DNS rebinding

Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods

Infrahub: Deleted and expired API tokens can still authenticate

PyInstaller has local privilege escalation vulnerability

xml2rfc is vulnerable to arbitrary file reads through prepped files

Indico vulnerable to Cross-Site Scripting via LaTeX math code

Indico may disclose unauthorized user details access via legacy API

copyparty: Sharing a single file does not fully restrict access to other files in source folder

SGLang Remote Code Execution Vulnerability via Unsafe Deserialization in update_weights_from_tensor

OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload

Django is subject to SQL injection through its column aliases

Fides' Admin UI User Password Change Does Not Invalidate Current Session

Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation

Fides Webserver API Rate Limiting Vulnerability in Proxied Environments

Fides has a Lack of Brute-Force Protections on Authentication Endpoints

internetarchive Vulnerable to Directory Traversal in File.download()

TkEasyGUI Affected by Uncontrolled Search Path Element Issue

xgrammar vulnerable to denial of service by huge enum grammar

pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability

Weblate is a web based localization tool

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path

github.com/argoproj/argo-cd: Project API Token Exposes Repository Credentials (CVE-2025-55190)

langchain-community: Langchain-community insecure XML parsing (CVE-2025-6984)

DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more

ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header

MobSF Path Traversal in GET /download/<filename> using absolute filenames

MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction

Logging user input may result in poisoning logs with ANSI escape sequences

github.com/gorilla/csrf improperly validates TrustedOrigins allowing CSRF attacks

Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to t…