Important: Red Hat Security Advisory: Red Hat Ceph Storage

A new version of Red Hat build of Ceph Storage has been released The Red Hat Storage Ceph container images are based on the latest ubi9 base image and Ceph 7.1. This release updates to the latest version...

Better Auth affected by external request basePath modification DoS

Summary Affected versions of Better Auth allow an external request to configure baseURL when it isn’t defined through any other means. This can be abused to poison the router’s base path, causing all routes to return 404 for all users. This issue is only exploitable when baseURL is not explicitly...

External Control of File Name or Path

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to External Control of File Name or Path via the getBaseURL function. An attacker can cause all routes to return 404 errors for all users by sending a crafted...

GHSA-569Q-MPPH-WGWW Better Auth affected by external request basePath modification DoS

Summary Affected versions of Better Auth allow an external request to configure baseURL when it isn’t defined through any other means. This can be abused to poison the router’s base path, causing all routes to return 404 for all users. This issue is only exploitable when baseURL is not explicitly...

Security Bulletin: Due to use of Apache Jena SDB, IBM Jazz Reporting Service is affected by a JDBC Deserialisation attack.

Summary Apache Jena SDB is used internally by IBM Jazz Reporting Service CVE-2022-45136. Vulnerability Details CVEID:CVE-2022-45136 DESCRIPTION: Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the...

PT-2025-48576

Name of the Vulnerable Software and Affected Versions Portkey.ai Gateway versions prior to 1.14.0 Description The Portkey.ai Gateway, a fast AI Gateway with integrated guardrails, is susceptible to Server-Side Request Forgery SSRF attacks in versions before 1.14.0. The gateway determines the...

CVE-2025-13789

A vulnerability was found in ZenTao up to 21.7.6-8564. This affects the function makeRequest of the file module/ai/model.php. The manipulation of the argument Base results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and could be used...

[SECURITY] [DLA 4387-1] qtbase-opensource-src security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4387-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler November 29, 2025 https://wiki.debian.org/LTS -...

How CVSS v4.0 works: characterizing and scoring vulnerabilities

The Common Vulnerability Scoring System CVSS provides software developers, testers, and security and IT professionals with a standardized way to assess vulnerabilities. You can use CVSS to assess the threat level of each vulnerability and then prioritize mitigation accordingly. This article...

Fedora: Security Advisory (FEDORA-2025-b1d7d7f8db)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-54b43715b6)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-b3bd444d1f)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Malicious code in accounts-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07acaccf5cae78ad4bfd5f967e15c5ba68180c1350310492a9065ca97124bf26 The package accounts-base was found to contain malicious code. Source: ghsa-malware cf76e57ba69c401756a0d9279f66fcd197667ce73a011c643099737d08dc306c...

MAL-2025-191480 Malicious code in accounts-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07acaccf5cae78ad4bfd5f967e15c5ba68180c1350310492a9065ca97124bf26 The package accounts-base was found to contain malicious code. Source: ghsa-malware cf76e57ba69c401756a0d9279f66fcd197667ce73a011c643099737d08dc306c...

@eui/deps-base (>=21.0.0-alpha.10, <=21.0.0-next.28), @eui/deps-base-light (>=21.0.0-alpha.10, <=21.0.0-next.28) potentially affected by CVE-2025-66035 via @angular/common (21.0.0-rc.2)

@angular/common NPM version 21.0.0-rc.2 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/common and may be impacted: - @eui/deps-base =21.0.0-alpha.10, =21.0.0-alpha.10, =21.0.0-next.28 Source cves: CVE-2025-66035 Source advisory:...

@eui/deps-base (>=21.0.0-alpha.10, <=21.0.0-next.28), @eui/deps-base-light (>=21.0.0-alpha.10, <=21.0.0-next.28) potentially affected by CVE-2025-66035 via @angular/common (21.0.0-rc.2)

@angular/common NPM version 21.0.0-rc.2 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/common and may be impacted: - @eui/deps-base =21.0.0-alpha.10, =21.0.0-alpha.10, =21.0.0-next.28 Source cves: CVE-2025-66035 Source advisory:...

Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates

Summary IBM App Connect Enterprise Certified Container ACEcc is built on the Red Hat Universal Base Images. ACEcc operator versions 12.0.18 LTS and 12.18.0 contain fixes to the listed CVEs found in the base images. This bulletin provides patch information to address the reported vulnerabilities...

Exploring Hidden Geographic Disparities in Android Apps

While mobile app evolution has been widely studied, geographical variation in app behavior remains largely unexplored. This paper presents a large-scale study of location-based Android app differentiation, uncovering two important and underexamined phenomena with security and fairness implication...

EUVD-2025-199427

Malicious code in @voiceflow/base-types npm...

Malicious code in @voiceflow/base-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58f955f868f3684364e34509e8ac923e40a6b84bf081690378886f6a64d77721 The package @voiceflow/base-types was found to contain malicious code. Source: ghsa-malware...