CVE-2025-65276

An unauthenticated administrative access vulnerability exists in the open-source HashTech project https://github.com/henzljw/hashtech 1.0 thru commit 5919decaff2681dc250e934814fc3a35f6093ee5 2021-07-02. Due to missing authentication checks on /adminindex.php, an attacker can directly access the...

CVE-2025-65276

An unauthenticated administrative access vulnerability exists in the open-source HashTech project https://github.com/henzljw/hashtech 1.0 thru commit 5919decaff2681dc250e934814fc3a35f6093ee5 2021-07-02. Due to missing authentication checks on /adminindex.php, an attacker can directly access the...

PT-2025-48122

The RupsMon.exe service executable in UPSilon 2000 has insecure permissions, allowing the 'Everyone' group Full Control. A local attacker can replace the executable with a malicious binary to execute code with SYSTEM privileges or simply change the config path of the service to a command; startin...

PT-2025-48180

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.3 through 18.4.4 GitLab CE/EE versions 18.5 through 18.5.2 GitLab CE/EE versions 18.6 through 18.6.0 Description A flaw exists in GitLab CE/EE that, under specific conditions, could allow an unauthenticated user to joi...

CVE-2025-65276

The open-source HashTech project (versions 1.0 through commit 5919decaff2681dc250e934814fc3a35f6093ee5 ) contains an unauthenticated administrative access vulnerability. Due to missing authentication checks on the /admin_index.php endpoint, an attacker can directly access the admin dashboard with...

GHSA-8FRV-Q972-9RQ5 cggmp24 and cggmp21 are vulnerable to signature forgery through altered presignatures

Impact This attack is against presignatures used in very specific context: Presignatures + HD wallets derivation: security level reduces to 85 bits \ Previously users could generate a presignature, and then choose a HD derivation path while issuing a partial signature via...

CVE-2025-66017 CGGMP21 presignatures can be used in the way that significantly reduces security

CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing requires 3 preprocessing rounds, identifiable abort, and a key refresh protocol. In versions 0.6.3 and prior of cggmp21 and version 0.7.0-alpha.1 of cggmp24, presignatures can be used in the way that significantly reduces...

CVE-2025-64063

Primakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks when processing requests. Specifically, a standard user can exploit this flaw by sending direct HTTP requests to administrative endpoints, bypassing the UI restrictions. This allows the attacker to manipulate...

PT-2025-47997

The Autochat Automatic Conversation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp ajax nopriv auycht saveCid' AJAX endpoint in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to...

WordPress AuthorSure plugin cross-site request forgery vulnerability

WordPress AuthorSure plugin is an open source plugin designed for the WordPress platform, mainly used to manage the submission process of multi-author sites. WordPress AuthorSure plugin has a cross-site request forgery vulnerability, the vulnerability stems from the lack of random number validati...

kernel security update

5.14.0-611.8.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 248176...

openssl security update

3.5.1-4.0.1 - Enable openssl-fips-provider dependency Orabug: 36504822 - Temporary disable openssl-fips-provider dependency Orabug: 36504822 - Replace upstream references Orabug: 34340177 3.5.1.openela.0.1 - Add OpenELA specific changes 1:3.5.1-4 - Fix CVE-2025-9230 Resolves: RHEL-115929...

CVE-2025-64063

The Primakon Pi Portal version 1.0.18 is vulnerable to an improper authorization flaw (CWE-285 ) where API endpoints fail to enforce sufficient access controls. A standard user can bypass UI restrictions by sending direct HTTP requests to administrative endpoints. This allows for unauthorized acc...

kernel security update

5.14.0-611.9.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 248176...

Malicious code in use-unsaved-changes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96deeb533a3de753f2de9201e46a0a8ccfa79d22d848ed8cbb20f19b36242ae6 The package use-unsaved-changes was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199008

Malicious code in use-unsaved-changes npm...

MAL-2025-190941 Malicious code in use-unsaved-changes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96deeb533a3de753f2de9201e46a0a8ccfa79d22d848ed8cbb20f19b36242ae6 The package use-unsaved-changes was found to contain malicious code. Source: ghsa-malware...

CVE-2025-65012

Kirby is an open-source content management system. From versions 5.0.0 to 5.1.3, attackers could change the title of any page or the name of any user to a malicious string. Then they could modify any content field of the same model without saving, making the model a candidate for display in the...

USN-7851-2: runC regression

USN-7851-1 fixed vulnerabilities in runC. The introduction of a new upstream release has caused regressions in runc-app and runc-stable. This update fixes the problem. Original advisory details: Lei Wang and Li Fubang discovered that runC incorrectly handled masked paths. An attacker could possib...

openSUSE 16 Security Update : tiff (openSUSE-SU-2025-20049-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025-20049-1 advisory. tiff was updated to 4.7.1: Software configuration changes: Define HAVEJPEGTURBODUALMODE812 and LERCSTATIC in tifconfig.h. CMake: define...