Aggregator

Critical Apache Tika Core Vulnerability Exploited by Uploading Malicious PDF

Cyber Security News
1 month 1 week ago

A critical security vulnerability in Apache Tika has been discovered that allows attackers to compromise systems by uploading specially crafted PDF files. Organizations worldwide are urged to patch immediately. Apache Tika is a popular open-source toolkit used by thousands of organizations to extract text and metadata from documents, including PDFs, Word files, and images. Apache […]

The post Critical Apache Tika Core Vulnerability Exploited by Uploading Malicious PDF appeared first on Cyber Security News.

Abinaya

CVE-2025-64187 | OctoPrint up to 1.11.3 File cross site scripting (GHSA-crvm-xjhm-9h29)

Vuldb Updates
1 month 1 week ago
A vulnerability has been found in OctoPrint up to 1.11.3 and classified as problematic. The impacted element is an unknown function of the component File Handler. The manipulation leads to basic cross site scripting. This vulnerability is documented as CVE-2025-64187. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.
vuldb.com

CVE-2025-64511 | 1Panel-dev MaxKB up to 2.3.0 Tool server-side request forgery (GHSA-9287-g7px-9rp4)

Vuldb Updates
1 month 1 week ago
A vulnerability has been found in 1Panel-dev MaxKB up to 2.3.0 and classified as critical. This impacts an unknown function of the component Tool Module. The manipulation leads to server-side request forgery. This vulnerability is listed as CVE-2025-64511. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.
vuldb.com

CVE-2025-64703 | 1Panel-dev MaxKB up to 2.3.0 Tool information disclosure (GHSA-qwvm-x4xh-g2qq)

Vuldb Updates
1 month 1 week ago
A vulnerability was found in 1Panel-dev MaxKB up to 2.3.0. It has been classified as problematic. Affected by this vulnerability is an unknown functionality of the component Tool Module. This manipulation causes information disclosure. This vulnerability is registered as CVE-2025-64703. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.
vuldb.com

CVE-2025-13120 | mruby up to 3.4.0 src/array.c sort_cmp use after free (Issue 6649)

Vuldb Updates
1 month 1 week ago
A vulnerability was found in mruby up to 3.4.0. It has been declared as critical. This vulnerability affects the function sort_cmp of the file src/array.c. Such manipulation leads to use after free. This vulnerability is traded as CVE-2025-13120. An attack has to be approached locally. Furthermore, there is an exploit available. It is advisable to implement a patch to correct this issue.
vuldb.com

Chinese Hackers Have Started Exploiting the Newly Disclosed React2Shell Vulnerability

The Hackers News
1 month 1 week ago
Two hacking groups with ties to China have been observed weaponizing the newly disclosed security flaw in React Server Components (RSC) within hours of it becoming public knowledge. The vulnerability in question is CVE-2025-55182 (CVSS score: 10.0), aka React2Shell, which allows unauthenticated remote code execution. It has been addressed in React versions 19.0.1, 19.1.2, and 19.2.1. According
The Hacker News

Managed ad