Advisories

Cross-Site Scripting in ntopng Login Page Using RTL Override

Buffer overflow in Blink

Out of bounds write in Crashpad

Out of Bound Write in ALSA

Uninitialised bytes on the wire in bridge MRP test frames leak kernel memory to the network.

Out of Bound Write with MMAP in ALSA (LPE)

Out of Bound Write in ALSA

Use After Free in ALSA

X.25 Socket Use-After-Free Caused by Timer Callbacks (LPE)

Use After Free in VXLAN (LPE)

Use After Free in SCTP (LPE)

ALSA: ump: fix double free of out_cvts on rawmidi error

ALSA: usb-audio: fix use-after-free in ump_to_endpoint()

ALSA: usb-audio: fix stack info leak in RME Digiface status

ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()

LPE: Out-of-bounds write in the Linux kernel SMC-D subsystem.

Unauthenticated Arbitrary File Read can lead to RCE

Inappropriate implementation in V8

Inappropriate implementation in WebAudio.

Type Confusion in WebAudio.

Invalid pointer in the DOM: Bindings (WebIDL) component

Out-of-bounds write in WebAudio allowed a remote attacker to execute arbitrary code inside the Chrome sandbox via a crafted HTML page.

Use-after-free in Exim's BDAT body parsing path under certain GnuTLS configurations, allowing unauthenticated remote code execution.

Command injection in Microsoft Bing Images allows an unauthorized attacker to execute code over a network.

OS command injection in Microsoft Bing Images allows an unauthorized attacker to execute code over a network.

Remote code execution vulnerability caused by unrestricted upload of a file with a dangerous type.

Unauthenticated IDOR in Spree API allows access to guest address information without valid credentials or session cookies.

Authenticated IDOR in Spree API order modification allows a user to retrieve other users' address information by manipulating address identifiers.

GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

SQL injection in Chef Automate compliance service before 4.13.295 allows access to restricted functionality through improperly neutralized SQL command inputs.

XSS in Apache JSPWiki Image plugin allows crafted requests to execute JavaScript in a victim's browser.

XSS in Apache JSPWiki header link and markdown processing allows crafted wiki markup to execute JavaScript in a victim's browser.

SQL injection in the Z-Push IMAP backend before 2.7.6 via unparameterized queries using the Basic Authentication username field.

XML External Entity (XXE) injection in Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion.

XXE in GeoTools XSD schema handling can affect GeoServer, GeoTools, and GeoNetwork XML processing paths.

Arbitrary code execution in number generator sequence handling allows stored code to execute when getNextNumber is called.

Reflected XSS in PAN-OS GlobalProtect gateway and portal features can execute JavaScript in the browser of an authenticated Captive Portal user.

SSRF in LNbits LNURL authentication callback handling allows attacker-controlled callback URLs to access internal network resources.

Druid management proxy URL handling can be abused for SSRF, XSS, and open redirect behavior by an authenticated user.

XXE in LocalS3 bucket creation endpoint before 1.21 allows SSRF and leakage of internal service responses through CreateBucketConfiguration XML parsing.

Path traversal in the GHOSTS photo retrieval endpoint allows arbitrary file reads through crafted NPC photoLink values.

Path traversal and local file read in ZOO-Project Gdal_Translate VRT handling allows unauthenticated remote reads of arbitrary server files.

SSRF in Label Studio's S3 storage endpoint configuration allows requests to arbitrary internal services via a custom S3 endpoint URL.

XSS in Label Studio's /projects/upload-example endpoint allows arbitrary HTML or JavaScript injection through crafted label_config query data.

Path traversal in Label Studio SDK export functionality allows authenticated arbitrary file reads through crafted image field values.

Remote code execution may be possible in web-accessible Homarus installations via the Authorization header and problematic CLI interpolation.

Remote code execution is possible in web-accessible Hypercube installations via the X-Islandora-Args header.

XSS in the ZOO-Project WPS EchoProcess service allows attacker-supplied SVG content to execute JavaScript in a victim's browser.

Reflected XSS in the ZOO-Project WPS publish.py CGI script allows JavaScript injection through the jobid parameter.

Path traversal in S3Proxy filesystem and filesystem-nio2 storage backends can expose local files to authenticated clients.

Crafted URLs can inject malicious input into HTTP responses, leading to HTTP response splitting and XSS.

Path traversal in the ZOO-Project Echo example allows arbitrary file download through attacker-controlled caching parameters.

Path traversal in EDDI backup export functionality allows access to sensitive container files through the botFilename parameter.

Stored XSS in WikiDocs before 1.0.65 via KaTeX parser mishandling of user-controlled data after $$\\.

SSRF and URI validation bypass in 2FAuth account preview allows the application to fetch attacker-supplied URLs.

Stored XSS in 2FAuth allows JavaScript execution through uploaded SVG images rendered with improper headers.

Semicolon path injection bypasses authentication on /api;/config, and HOCON file inclusion can expose local files.

Remote code execution through unsafe expression evaluation in numexpr, exploited by XBOW through TiTiler's expression parser.