Oracle Linux 7 : xorg-x11-server (ELSA-2025-22040)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-22040 advisory. - Security update for CVE-2025-62229 CVE-2025-62230 CVE-2025-62231 Orabug: 38691191 - Fix CVE-2025-49175, CVE-2025-49176, CVE-2025-49178,...

WordPress plugin Contact Form 7 with ChatWork 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-63068

CVE-2025-63068 : Affected is the WordPress plugin Contact Form 7 Dynamic Text Extension . The issue is an improper neutralization of script-related HTML tags in the plugin, leading to a Basic XSS / Code Injection vulnerability. Affected versions are the plugin up to and including 5.0.3 (from the ...

PT-2025-49884

Missing Authorization vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms cf7-salesforce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integration for Salesforce and Contact Form 7,...

CVE-2025-64498 Tuleap has a Cross-Site Request Forgery (CSRF) vulnerability

Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap Community Edition versions below 17.0.99.1762444754 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 allow attackers trick victims into changing tracker general settings. Th...

Debian dla-4389 : libtorch-dev - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4389 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4389-1 [email protected] https://www.debian.org/lts/security/...

CVE-2025-12848

Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting XSS vulnerability in the file name renderer. An unauthenticated attacker can exploit this vulnerability by uploading a file with a malicious filename containing JavaScript code e.g., "" to a Webform node with a...

AZL-71267 CVE-2025-13837 affecting package python3 for versions less than 3.12.9-7

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues...

AZL-71264 CVE-2025-13836 affecting package python3 for versions less than 3.12.9-7

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS...

EUVD-2025-199558

An authentication bypass vulnerability has been identified in the IFTTT integration feature. A remote, authenticated attacker could leverage this vulnerability to potentially gain unauthorized access to the device. This vulnerability does not affect Wi-Fi 7 series models. Refer to the 'Security...

Fedora 43 : python-mkdocs-include-markdown-plugin (2025-1b1bb708af)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-1b1bb708af advisory. v7.2.0 New features - Add new argument order to sort multiple inclusions. v7.1.8 Bug fixes - Escape substitution placeholders to prevent malformed...

A Bootiful Podcast: The legendary Sébastien Deleuze on all that's new and nice in Spring Framework 7

Hi, Spring fans! Happy Spring Boot 4.0 release day! Make sure to get the bits on the Spring Initializr you know - start.spring.io! This release is packed with new features, a lot of which comes from Spring Framework 7. To help break it down for us this week, we’re joined by none other than the...

Oracle Linux 7 : squid (ELSA-2025-19167)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-19167 advisory. - Fixes CVE-2025-62168, squid: Squid vulnerable to information disclosure via - Fixes CVE-2025-54574, add URN access disabling config options Orabug: 38350105 ...

CVE-2025-49795 affecting package libxml2 for versions less than 2.11.5-7

CVE-2025-49795 affecting package libxml2 for versions less than 2.11.5-7. A patched version of the package is available...

AZL-70319 CVE-2025-47913 affecting package podman 5.6.1-7

SSH clients receiving SSHAGENTSUCCESS when expecting a typed response will panic and cause early termination of the client process...

EUVD-2025-137004

Malicious code in riya-7 npm...

EUVD-2025-141487

Malicious code in hokage-7 npm...

Malicious code in riya-7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4810bc0c14186540e44f093caa65f9cfac3cfcf456527a49097e1d694a1f651 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hokage-7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 042018ebe8dd474c23147d714f5b0a2e883b4c3b7b9e19af096a75dab87e577a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ira-7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38dc12e793251b7a359ecf60a628711581878bc0d492ed76819698b16b942610 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...