RHEL 10 : valkey (RHSA-2025:11401)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:11401 advisory. Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists,...

WordPress Attachment Manager plugin <= 2.1.2 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by johska in WordPress Plugin Attachment Manager versions = 2.1.2...

WordPress School Management System plugin <= 93.1.0 - Authenticated (Subscriber+) Local File Inclusion to Privilege Escalation via Password Update vulnerability

Authenticated Subscriber+ Local File Inclusion to Privilege Escalation via Password Update vulnerability discovered by Thái An in WordPress Plugin School Management versions = 93.1.0...

EUVD-2025-21909

CrushFTP 10 before 10.8.5 and 11 before 11.3.423, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025...

WordPress Apollo - Sticky Full Width HTML5 Audio Player <= 3.4 - Cross Site Scripting (XSS) Vulnerability

WordPress Apollo - Sticky Full Width HTML5 Audio Player = 3.4 - Cross Site Scripting XSS Vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Apollo - Sticky Full Width HTML5 Audio Player versions = 3.4...

WordPress Webba Booking plugin <= 5.1.20 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin Webba Booking versions = 5.1.20...

WordPress JetPopup plugin <= 2.0.15 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by stealthcopter in WordPress Plugin JetPopup versions = 2.0.15...

CVE-2025-52687

creationtimestamp| type| source ---|---|--- 2025-07-16 07:29:10+00:00| seen| Telegram/JQr-qg-HSxLaEgjFwrPGHNrT8xVRvpQqwn17i0uGuKjXawM...

RHEL 10 : tomcat9 (RHSA-2025:11332)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:11332 advisory. Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages...

Oracle Linux 10 : glib2 (ELSA-2025-10855)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-10855 advisory. - Add patches for CVE-2024-52533 and CVE-2025-4373 Tenable has extracted the preceding description block directly from the Oracle Linux security...

Oracle Linux 10 : kernel (ELSA-2025-10854)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-10854 advisory. 6.12.0-55.21.1.0.10.OL10 - nvme-pci: remove two deallocate zeroes quirks Orabug: 37756650 - Add new Oracle Linux Driver Signing key 1 certificate Orabug:...

CVE-2025-34106

CVE-2025-34106 affects PDF Shaper v3.5 and v3.6. A buffer overflow occurs when using the “Convert PDF to Image” feature on a crafted PDF, allowing arbitrary code execution in the user context after the file is opened. Verified on Windows XP, 7, 8, and 10 via the PDFTools.exe component. Exploitati...

RHEL 10 : glibc (RHSA-2025:11066)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:11066 advisory. The glibc packages provide the standard C libraries libc, POSIX thread libraries libpthread, standard math libraries libm, and the name service cac...

WordPress Strong Testimonials plugin <= 3.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Fields vulnerability

Authenticated Author+ Stored Cross-Site Scripting via Custom Fields vulnerability discovered by ISMAILSHADOW in WordPress Plugin Strong Testimonials versions = 3.2.11...

CVE-2025-7618

creationtimestamp| type| source ---|---|--- 2025-07-14 10:24:36+00:00| seen| Telegram/FW8cnONoBD8ZO3NoexBBIU0dSreQEozlKfxpy1SbTNhHnc...

RHEL 10 : glib2 (RHSA-2025:10855)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10855 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in...

RHEL 10 : cloud-init (RHSA-2025:10844)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:10844 advisory. The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to...

WordPress Friends plugin <= 3.5.1 - Authenticated (Admin+) PHP Object Injection vulnerability

Authenticated Admin+ PHP Object Injection vulnerability discovered by Pham Nguyen Khoa in WordPress Plugin Friends versions = 3.5.1...

GHSA-QJMQ-H3CC-QV6W

creationtimestamp| type| source ---|---|--- 2025-07-10 20:18:47+00:00| seen| Telegram/pXxe8XI9mTW8yWY1Nl3-04J6wo96nS-LpCGFCKzO-5Tgl0 2025-07-10 20:18:48+00:00| seen| Telegram/Pg251So2l8iDRxAy6wiLQWBAZc72ZtkVSL5WWSapRXHyJ7Q...

Patch, track, repeat

Welcome to this week's edition of the Threat Source newsletter. We've made it halfway through 2025 already! It's been a while since I last wrote about CVEs and how free support for Windows 10 will end on October 14, 2025, leaving you with no more security fixes. While the CVE system remains the...