Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Software have been addressed in version 1.0.2.0. Vulnerability Details CVEID:CVE-2025-47273 DESCRIPTION: setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability ...

GO-2026-5423 vulnerabilities

Vulnerabilities for packages: grafana-fips, commercial-grafana, grafana...

GO-2025-3632 vulnerabilities

Vulnerabilities for packages: cilium-fips, cilium...

GO-2025-3660 vulnerabilities

Vulnerabilities for packages: dapr-fips, cosign-fips, kots, tfsec, kyverno-notation-aws-fips, policy-controller, conftest, conftest-fips, witness, spire-server, dapr, kyverno, kyverno-notation-aws, spire-server-fips, kyverno-fips, trivy-fips, trivy, cosign, policy-controller-fips...

GO-2025-4017 vulnerabilities

Vulnerabilities for packages: spegel-fips, traefik-fips, kubernetes-dns-node-cache, k8sgateway, coredns-fips, frp, syncthing, spegel, rke2-runtime, ipfs-cluster-fips, kubo, eks-distro-fips, teleport, dkron, dkron-fips, coredns, k8sgateway-fips, q, kubernetes-dns-node-cache-fips, syncthing-fips,...

GO-2025-4096 vulnerabilities

Vulnerabilities for packages: rancher-agent, virt-launcher, virt-handler, node-feature-discovery, rancher, kubernetes, falco-no-driver, nvidia-container-toolkit, grafana-alloy, buildah, rke2-runtime, eks-distro-fips, cluster-autoscaler, virt-handler-fips, podman, node-feature-discovery-fips,...

GO-2025-3678 vulnerabilities

Vulnerabilities for packages: buck2, zola, ztunnel-fips, xh, wasm-pack, sccache, pixi, samply, nushell, ztunnel, kdash, oranda, ntpd-rs, cargo-audit, fnm, wasmcloud, rustup, atuin, tealdeer, sqlx, parseable, qdrant, zed, deno, uv, zizmor, wasmtime, linkerd2-proxy, rustls-ffi, shadowsocks-rust,...

GO-2025-3437 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, argocd-image-updater-fips...

GO-2026-5418 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, argo-cd, argocd-image-updater-fips...

GO-2025-3774 vulnerabilities

Vulnerabilities for packages: rancher-agent, node-feature-discovery, rancher-system-agent, calico-fips, rancher, longhorn-share-manager-fips, yunikorn-k8shim-fips, kubernetes-csi-driver-hostpath, mesosphere-vsphere-csi, vcluster, argo-cd-fips, azuredisk-csi-fips, cluster-autoscaler,...

Zoo Management System 1.0 - SQL Injection

Zoo Management System 1.0 contains a SQL injection vulnerability via the username parameter on the login page. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalation

Privilege escalation vulnerability exists in the Frontend Login and Registration Blocks plugin for WordPress versions = 1.0.7. An unauthenticated attacker can exploit the AJAX endpoint flrblocksusersettingshandleajaxcallback to change the administrator's email address. Subsequently, the attacker...

EasyCVR <=2.1.2 - Information Disclosure

A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code of the file /api/v1/getbaseconfig. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit ha...

TRUfusion Enterprise <= 7.10.4.0 - Admin Contact Portal

TRUfusion Enterprise versions 7.10.4.0 and earlier contained a vulnerability that allowed unauthenticated access to the Internal Admin Contact Page, resulting in the disclosure of PII including partner and contact names. id: CVE-2025-27225 info: name: TRUfusion Enterprise = 7.10.4.0 - Admin Conta...

Spring Framework - Path Traversal

Spring Framework MVC applications deployed as WAR or with embedded Servlet containers that do not reject suspicious URI sequences and serve static resources with Spring resource handling contain a path traversal vulnerability, letting attackers access unauthorized files, exploit requires...

Versa Concerto API Path Based - Authentication Bypass

Authentication bypass in the Versa Concerto API, caused by URL decoding inconsistencies. It allowed unauthorized access to certain API endpoints by manipulating the URL path.This issue enabled attackers to bypass authentication controls and access restricted resources. id: CVE-2025-34027 info:...

Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation

A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the auth-tls-match-cn Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of...

Vipshop Saturn Console <= 3.5.1 - SQL Injection via ClusterKey Component

SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component. id: CVE-2025-29085 info: name: Vipshop Saturn Console = 3.5.1 - SQL Injection via ClusterKey Component author:...

MagnusBilling Alarm Module - Cross-Site Scripting

Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling Alarm Module modules allows authenticated stored cross-site scripting. This vulnerability is associated with program files protected/components/MagnusLog.Php.This issue affects MagnusBilling-...

DataEase 2.10.4-2.10.7 - Remote Code Execution

DataEase prior to version 2.10.8 contains a remote code execution caused by insecure backend JDBC link handling, letting authenticated users execute arbitrary code, exploit requires user authentication. id: CVE-2025-32966 info: name: DataEase 2.10.4-2.10.7 - Remote Code Execution author: ChrisJr4...