CVE-2025-59418

BunnyPad is a note taking software. Prior to version 11.0.27000.0915, opening files greater than or equal to 20MB causes buffer overflow to occur. This issue has been patched in version 11.0.27000.0915. Users who wish not to upgrade should refrain from opening files larger than 10MB.

• CWE-770

• https://github.com/GSYT-Productions/BunnyPad-SRC/commit/d9224eb5e13c24ac148a77dff93e53c21f066533
• https://github.com/GSYT-Productions/BunnyPad-SRC/security/advisories/GHSA-qhw4-c7x5-vxmj

Published

Sep 22, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59412CubeCart is an ecommerce software solution. Prior to version…5.4
• CVE-2025-59413CubeCart is an ecommerce software solution. Prior to version…6.5
• CVE-2025-59414Nuxt is an open-source web development framework for Vue.js.…3.1
• CVE-2025-59415Frappe Learning is a learning system that helps users struct…5.4
• CVE-2025-59416The Scratch Channel is a news website. If the user makes a f…7.2
• CVE-2025-59417Lobe Chat is an open-source artificial intelligence chat fra…6.1
• CVE-2025-59419Netty is an asynchronous, event-driven network application f…5.5
• CVE-2025-5942Netskope was notified about a potential gap in its agent (NS…5.7
• CVE-2025-59420Authlib is a Python library which builds OAuth and OpenID Co…7.5
• CVE-2025-59421Press, a Frappe custom app that runs Frappe Cloud, manages i…2.7
• CVE-2025-59422Dify is an open-source LLM app development platform. In vers…3.1
• CVE-2025-59424LinkAce is a self-hosted archive to collect website links. P…7.3