CVE-2025-62605 Mastodon quotes control can be bypassed

Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was added, but it is possible for an attacker to bypass these controls in Mastodon versions prior to 4.4.8 and 4.5.0-beta.2. Mastodon...

EUVD-2025-35213

Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was added, but it is possible for an attacker to bypass these controls in Mastodon versions prior to 4.4.8 and 4.5.0-beta.2. Mastodon...

CVE-2025-62605 Mastodon quotes control can be bypassed

Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was added, but it is possible for an attacker to bypass these controls in Mastodon versions prior to 4.4.8 and 4.5.0-beta.2. Mastodon...

SUSE CVE-2025-61909

Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script also used during systemctl reload icinga2 and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user...

Ubuntu: Security Advisory (USN-7818-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian dsa-6027 : golang-github-lxc-incus-dev - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6027 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6027-1 [email protected] https://www.debian.org/securit...

CVE-2025-61908

CVE-2025-61908 – Icinga 2 Denial of Service : Multiple vendor advisories confirm a vulnerability in Icinga 2 where creating an invalid reference (e.g., a reference to null) dereferences a null pointer and triggers a segmentation fault, crashing the daemon when a filter expression is provided via ...

EUVD-2025-34793

Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, when creating an invalid reference, such as a reference to null, dereferencing results in a segmentation fault. This can be used by any API user with access to an API endpoint that allows specifying a...

CVE-2025-61907

Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could access variables or objects that would otherwise be inaccessible for the user. This allows authenticated API users to learn information tha...

K000150752: BIG-IP HTTP/2 vulnerability CVE-2025-55669

Security Advisory Description When the BIG-IP Advanced WAF and ASM security policy and a server-side HTTP/2 profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel TMM to terminate. CVE-2025-55669 Impact Traffic is disrupted for new client...

Amazon Linux 2 : kernel, --advisory ALAS2-2025-3038 (ALAS-2025-3038)

The version of kernel installed on the remote host is prior to 4.14.355-280.698. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3038 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in...

Amazon Linux 2 : docker, --advisory ALAS2DOCKER-2025-076 (ALASDOCKER-2025-076)

The version of docker installed on the remote host is prior to 25.0.13-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2025-076 advisory. Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container...

Amazon Linux 2 : compat-libtiff3, --advisory ALAS2-2025-3021 (ALAS-2025-3021)

The version of compat-libtiff3 installed on the remote host is prior to 3.9.4-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3021 advisory. Write-What-Where in libtiff via TIFFReadRGBAImageOriented CVE-2025-9900 Tenable has extracted the preceding description...

Amazon Linux 2 : open-vm-tools, --advisory ALAS2-2025-3036 (ALAS-2025-3036)

The version of open-vm-tools installed on the remote host is prior to 12.3.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3036 advisory. VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with...

Amazon Linux 2 : squid, --advisory ALAS2-2025-3027 (ALAS-2025-3027)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3027 advisory. Squid through 7.1 mishandles ASN.1 encoding of long SNMP OIDs. This occurs in asnbuildobjid in lib/snmplib/asn1.c. CVE-2025-59362...

Important: open-vm-tools

Issue Overview: VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability ...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READ CVE-2022-50410 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 - Kernel-5.4 Extra. Visit this page to learn more about Amazon...

Malicious Package

Overview mad-8.2.1.2.2.8 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Debian dla-4329 : libfcgi-bin - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4329 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4329-1 [email protected] https://www.debian.org/lts/security/...

VulnCheck KEV: CVE-2013-2134

Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135...