CVE-2025-7546 affecting package gdb for versions less than 13.2-5

CVE-2025-7546 affecting package gdb for versions less than 13.2-5. A patched version of the package is available...

CVE-2025-53859 affecting package nginx for versions less than 1.25.4-5

CVE-2025-53859 affecting package nginx for versions less than 1.25.4-5. A patched version of the package is available...

Use of Weak Hash

Overview Affected versions of this package are vulnerable to Use of Weak Hash like the Md5 hash. An attacker can bypass file integrity verification by generating files with colliding MD5 hashes and distributing malicious content that passes integrity checks. Remediation Upgrade...

CVE-2025-59155 hackmd-mcp server-side request forgery in HTTP transport mode

hackmd-mcp is a Model Context Protocol server for integrating HackMD's note-taking platform with AI assistants. From 1.4.0 to before 1.5.0, hackmd-mcp contains a server-side request forgery SSRF vulnerability when the server is run in HTTP transport mode. Arbitrary hackmdApiUrl values supplied vi...

kernel: x86: fix user address masking non-canonical speculation issue

A flaw was found in the Linux kernel's handling of user address masking on x86 architectures. This vulnerability, similar to "Meltdown Lite," allows for speculative execution a CPU optimization technique to be exploited due to incorrect handling of non-canonical memory accesses in kernel space. A...

CVE-2025-10183 XML External Entity Injection in TecConnect 4.1

A blind XML External Entity XXE injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthenticated attacker to exfiltrate arbitrary files to an attacker-controlled server. TecConnect 4.1 is considered end-of-life as of December 2023. Users are advised to upgrade to TecCo...

CVE-2025-10183

CVE-2025-10183 describes a blind XML External Entity (XXE) injection in the OpenMessaging webservice of TecCom TecConnect 4.1, allowing an unauthenticated attacker to exfiltrate arbitrary files to a controller server. Affected: TecConnect 4.1 OpenMessaging webservice; root cause is XXE in OpenMes...

Advisory ROSA-SA-2025-2979

software: ghostscript 9.56.1 OS: ROSA-CHROME unaffected versions = ghostscript-9.56.1-5 affected versions ghostscript-9.56.1-5 CVE-ID: CVE-2023-52722 BDU-ID: 2024-07479 CVE-Crit: CRITICAL CVE-DESC.: A vulnerability in the afqkf psi/zmisc1.c file of the Ghostscript document processing, conversion,...

PT-2025-36738

Name of the Vulnerable Software and Affected Versions: TecCom TecConnect version 4.1 Description: The OpenMessaging webservice in TecCom TecConnect version 4.1 contains a blind XML External Entity XXE injection. This allows an unauthenticated attacker to exfiltrate arbitrary files to an...

CVE-2025-24294 affecting package ruby for versions less than 3.3.5-5

CVE-2025-24294 affecting package ruby for versions less than 3.3.5-5. A patched version of the package is available...

Linux Distros Unpatched Vulnerability : CVE-2021-46088

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution RCE. Any user with the Zabbix Admin role is able to run custom shell script on the...

QNAP Systems File Station 5 Unlimited Resource Allocation Vulnerability (CNVD-2025-20848)

QNAP Systems File Station 5威联通QNAP presents a file management application for browsing, uploading, downloading and managing files and folders stored on NAS devices, remote servers or external storage devices. An unrestricted resource allocation vulnerability exists in QNAP Systems File Station 5,...

QNAP Systems File Station 5 Null Pointer Dereference Vulnerability (CNVD-2025-20852)

QNAP Systems File Station 5威联通QNAP presents a file management application for browsing, uploading, downloading and managing files and folders stored on NAS devices, remote servers or external storage devices. A null pointer dereference vulnerability exists in QNAP Systems File Station 5, which ca...

QNAP Systems File Station 5 Null Pointer Dereference Vulnerability (CNVD-2025-20850)

QNAP Systems File Station 5威联通QNAP presents a file management application for browsing, uploading, downloading and managing files and folders stored on NAS devices, remote servers or external storage devices. A null pointer dereference vulnerability exists in QNAP Systems File Station 5, which ca...

CVE-2025-29874

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

CVE-2025-29888

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

CVE-2025-57811

Craft is a platform for creating digital experiences. From versions 4.0.0-RC1 to 4.16.5 and 5.0.0-RC1 to 5.8.6, there is a potential remote code execution vulnerability via Twig SSTI Server-Side Template Injection. This is a follow-up to CVE-2024-52293. This vulnerability has been patched in...

org.webjars.npm:ckeditor5 (>=44.1.0, <=44.3.0), org.webjars.npm:ckeditor__ckeditor5-adapter-ckfinder (>=44.1.0, <=44.3.0) +59 more potentially affected by CVE-2025-9670 via org.webjars.npm:turndown (7.2.0)

org.webjars.npm:turndown MAVEN version 7.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:turndown and may be impacted: - org.webjars.npm:ckeditor5 =44.1.0, =44.1.0, =44.1.0, =44.1.0, =44.1.0, =44.1.0, =44.1.0, =44.1.0, =44.1.0,...

CVE-2025-29899

An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We ha...

CVE-2025-29890

An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We ha...