Author name: UNDERCODE

The vulnerability exploits SurrealDB’s real-time LIVE query mechanism. When a user subscribes to a LIVE SELECT query on a table,

The vulnerability in Hutool stems from improper input sanitization within the `QLExpressEngine` class. This engine is used to evaluate dynamic

The vulnerability CVE-2024-32867 in kcp stems from a missing validation function in the code handling virtual workspaces. Specifically, the `DefaultDynamicDelegatedStoreFuncs`

The CVE-2024-45619 vulnerability stems from improper handling of the `window.postMessage` API within the client-side code of Apollo’s Embedded Sandbox and

In Apache Airflow 3, a new security model was implemented to make sensitive fields in Connections (like passwords) write-only, meaning

The vulnerability exists in the `sanitize` function within `lib/sanitize.js` of the express-xss-sanitizer middleware. This function is designed to recursively traverse

The vulnerability in get-jwks stems from an insecure cache key generation algorithm. The library constructs a cache key by concatenating

The vulnerability CVE-2025-45405 is a memory leak within the headless API endpoint responsible for handling `StructuredContents` in Liferay. This flaw

The vulnerability CVE-2025-4255 exists in the `lib.set` function of dref version 0.1.2. This function is designed to set nested property

The vulnerability exists within the `stream_handler` function of the `ml_logger/server.py` component. This function is responsible for handling requests to stream

The vulnerability, CVE-2025-XXXXX, is an argument injection flaw in the SonarQube Scan Action for GitHub. It affects Windows runners using

The vulnerability, CVE-2025-4255, exists in the `preProcess` function of apidoc-core versions up to and including 0.15.0. This function is responsible

The vulnerability in toggle-array v1.0.1 and prior exists within the `enable` and `disable` functions. These functions are designed to toggle

The vulnerability stems from a missing server-side validation check on the `username` field within the Rancher Manager’s user API. In

The vulnerability exists in the `set` and `config` functions of spmrc versions 1.2.0 and earlier. These functions are responsible for

The vulnerability exists in the `/meta/proxy` endpoint of Rancher Manager. When creating a new cloud credential, the endpoint forwards requests

The vulnerability exploits the SAML authentication flow between Rancher Manager and the Rancher CLI. When a user initiates a login

The vulnerability exists in the `mp.addEventHandler` function of the mpregular framework. This function is designed to add event handlers to

The vulnerability exists in the `byGroupAndType` function of sassdoc-extras. This function is designed to process and group SassDoc annotation data.

How the mentioned CVE works: A flaw was introduced in Apache HTTP Server 2.4.49. A change to the path normalization

The CVE-2025-42586 vulnerability in ts-fns arises from improper input sanitization within the library’s `assign` function. This function is designed to

The vulnerability in node-cube arises from improper input control during object initialization. The `Cube.init` function, which merges user-provided configuration objects,

The vulnerability exists in the `util-deps.addFileDepend` function. This function is responsible for managing file dependencies by merging user-supplied objects into

The vulnerability exists in the `Rack::QueryParser` component of Rack versions prior to 2.2.18. The core issue is a mismatch between

The vulnerability exists within the Terraformer component used by Gardener extensions for infrastructure provisioning. A user with administrative privileges in

The vulnerability in messageformat versions prior to 2.3.0 stems from improper input sanitization of nested message keys. When parsing a

The vulnerability exists in the `attachToObject` function. This function is responsible for merging user-supplied properties into a target object. The

The vulnerability in cors-anywhere arises from its default configuration as an open proxy. When an instance lacks proper access controls,

The vulnerability exists in the `log_handler` function within the `ml_logger/server.py` file, specifically in the Ping Handler component. The function insecurely

The vulnerability exists in the `log_handler` function within ml_logger/server.py. When handling requests to log data, the function uses user-supplied input

The CVE describes a software supply chain attack where a malicious actor gained publishing rights to the Nx build system

The vulnerability exists due to improper input validation within the VPN web server component of Cisco ASA and FTD software.

The vulnerability resides in the VPN web server component of Cisco ASA and FTD software. It stems from improper validation

How the mentioned CVE works: A flaw was introduced in Apache HTTP Server 2.4.49 with a change to the path

The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a use-after-free flaw in the Linux kernel’s filesystem layer. The issue resides

The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a critical use-after-free flaw in the Linux kernel’s filesystem layer. The vulnerability

The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a critical use-after-free flaw in the Linux kernel’s filesystem layer. The issue

The vulnerability, CVE-2025-XXXXX, exists in the `resolve_ast_by_type` function of Llama Stack versions prior to v0.2.20. This function is responsible for

The vulnerability arises from improper validation of the `X-Forwarded-Host` and `X-Forwarded-Proto` HTTP headers within the OIDC redirect handling logic. The

The CVE-2021-41773 vulnerability exists in Apache HTTP Server versions 2.4.49. A flaw in the path normalization algorithm allows an attacker

The CVE-2021-41773 vulnerability exists in Apache HTTP Server versions 2.4.49. A flaw was introduced in the normalization of file paths

The CVE-2025-40456 vulnerability in Mangati NovoSGA stems from inadequate input sanitization within the SVG file handler component, specifically in the

This vulnerability exists in pip’s fallback code for extracting tar archives on Python versions that do not implement PEP 706.

The vulnerability in messageformat for Node.js (versions prior to 3.0.1) stems from improper input sanitization of nested message keys. When

The vulnerability in csvtojson arises from improper input sanitization of nested column headers during CSV-to-JSON conversion. The `parser_jsonarray` component fails

The vulnerability exists because the EmbedVideo extension does not properly sanitize the value of the `data-iframeconfig` attribute provided via wikitext.

The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a use-after-free flaw in the Linux kernel’s filesystem layer. The issue resides

The vulnerability exists within the AdminServer component of Apache ZooKeeper. AdminServer provides an HTTP interface for administrative commands, including creating

The vulnerability CVE-2025-XXXXX in Claude Code stems from an unsafe interaction with Yarn’s plugin autoloading mechanism. In Yarn versions 2.0

The CVE-2025-XXXXX vulnerability in Apache IoTDB stems from an incomplete patch for a previous issue (CVE-2024-20XXX) concerning the handling of

This vulnerability, CVE-2025-XXXXX, exists in Apache IoTDB’s RPC framework due to insecure deserialization of user-supplied data. Attackers can exploit this

The CVE-2024-XXXX vulnerability stems from insufficient destination address validation in Omni’s SideroLink WireGuard interface. Omni configures its WireGuard interface to

The vulnerability in tar-fs arises from an incomplete validation of symbolic links within tar archives when the extraction destination is

The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a use-after-free flaw in the Linux kernel’s sequence file system. The issue

This vulnerability stems from a flaw in the Single Log-Out (SLO) API implementation within Liferay Portal and DXP. The system

The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a critical use-after-free flaw in the Linux kernel’s filesystem layer. The issue

The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a use-after-free flaw in the Linux kernel’s filesystem layer. The issue resides

The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a critical use-after-free flaw in the Linux kernel’s filesystem layer. The issue

The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a critical use-after-free flaw in the Linux kernel’s filesystem layer. The issue

The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a use-after-free flaw in the Linux kernel’s filesystem layer. The issue resides

The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a use-after-free flaw in the Linux kernel’s sequence file system operation functionality.

The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a critical use-after-free flaw in the Linux kernel’s filesystem layer. The vulnerability

How the mentioned CVE works: CVE-2021-41773 is a critical path traversal vulnerability in Apache HTTP Server versions 2.4.49. A flaw

How the mentioned CVE works: A flaw was introduced in Apache HTTP Server 2.4.49 with a change to the path

The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a use-after-free flaw in the Linux kernel’s filesystem layer. The issue resides

How the mentioned CVE works: A flaw was introduced in Apache HTTP Server versions 2.4.49. A change to the path

How the CVE Works The vulnerability exists in the Admin Log Viewer feature of S-Cart versions up to and including

The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a critical use-after-free flaw in the Linux kernel’s filesystem layer. The issue

The vulnerability exists in the `Parser.parse` method within the HTTP trailer parsing logic. After processing the final chunk of a

The vulnerability in astral-tokio-tar arises from two distinct flaws in path sanitization during TAR archive extraction. First, the `Entry::unpack_in_raw` API

The vulnerability, CVE-2025-XXXXX, exists in the `_do_use_weight_decay` method of the `AdamWeightDecay` optimizer within the Hugging Face Transformers library. This method

How the CVE Works: The vulnerability resides in the Jakarta Multipart parser of Apache Struts. An attacker can exploit this

How the mentioned CVE works: This CVE is currently in a reserved state by a CVE Numbering Authority (CNA). No

The CVE-2025-XXXXX vulnerability in WSO2 carbon-apimgt arises from insufficient input sanitization within the API Publisher portal’s document upload feature. An

The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a use-after-free flaw in the Linux kernel’s filesystem layer. The issue resides

How the mentioned CVE works: CVE-2021-41773 is a critical path traversal vulnerability in Apache HTTP Server versions 2.4.49. A flaw

How the mentioned CVE works: A flaw was introduced in Apache HTTP Server 2.4.49 with a change to the path

This CVE describes an Insecure Direct Object Reference (IDOR) vulnerability within the commerce order notes functionality of Liferay Portal and

The CVE-2025-XXXXX vulnerability in DNN Platform stems from inadequate input sanitization for HTML content within module s. Authenticated users with

The vulnerability CVE-2025-22087 exists within the audit event logging mechanism of Liferay Portal and DXP. When a user sets or

The CVE-2025-XXXXX vulnerability in DNN arises from inadequate sanitization of user-supplied input within the profile URL path. When a user

The vulnerability, CVE-2025-47140, stems from an improper access control mechanism within the Batch Engine component of Liferay. This engine handles

The vulnerability exploits a legacy feature in DNN that allows loading a specific theme via query parameters like “&theme=MyVulnerableTheme”. This

The CVE-2025-XXXXX vulnerability in H2O stems from improper deserialization of JDBC connection parameters. Attackers can exploit this by supplying a

The vulnerability exists in the `createLink.openLink` function. This function accepts a base64-encoded URL, decodes it, and directly sets the decoded

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw within Liferay’s notifications widget. The issue arises due to insufficient input

The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a use-after-free flaw in the Linux kernel’s sequence file system operation. The

The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a use-after-free flaw in the Linux kernel’s filesystem layer. The issue resides

The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a use-after-free flaw in the Linux kernel’s sequence file system operation functionality.

The vulnerability in the `getTags()` API of the `@conventional-changelog/git-client` library stems from its failure to properly sanitize user-supplied parameters before

The vulnerability in git-commiters arises from its insecure use of the `child_process.exec` function. The `gitCommiters(options, callback)` API function constructs a

The CVE-2025-XXXXX vulnerability in Mailgen stems from improper neutralization of user-supplied input during the generation of plaintext emails. The `Mailgen.generatePlaintext(email)`

The vulnerability exists in the file download endpoint of the Mattermost Boards plugin. The affected versions fail to enforce proper

The vulnerability, CVE-2021-43826, stems from an unsafe use of the `strcpy` function within the `ldlogger` library, a component executed by

The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a use-after-free flaw in the Linux kernel’s filesystem layer. The issue resides

The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a use-after-free flaw in the Linux kernel’s filesystem layer. The issue resides

Ammonia is an HTML sanitization library. The vulnerability arises from its incorrect handling of embedded SVG and MathML content when

Authlib’s JWS verification fails to enforce RFC 7515 §4.1.11 for critical header parameters. The `crit` header lists parameters that a

The CVE-2025-12345 vulnerability is a Cross-Site Request Forgery flaw in Liferay Portal’s server license registration endpoint. The affected component fails

The CVE describes an Insecure Direct Object Reference (IDOR) vulnerability within the Contacts Center widget of the Liferay platform. The