PT-2025-51974

Name of the Vulnerable Software and Affected Versions Storybook versions prior to 7.6.21 Storybook versions prior to 8.6.15 Storybook versions prior to 9.1.17 Storybook versions prior to 10.1.10 Description Storybook’s handling of environment variables defined in a .env file can, in certain...

Fedora: Security Advisory (FEDORA-2025-eb0eab6793)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 42 : conda-build (2025-eb0eab6793)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-eb0eab6793 advisory. Update to 25.4.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

EUVD-2025-203691

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/hdmi: Fix breakage at probing nvhdmi-mcp driver After restructuring and splitting the HDMI codec driver code, each HDMI codec driver contains the own buildcontrols and buildpcms ops. A copy-n-paste error put the wrong...

CVE-2025-68205

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/hdmi: Fix breakage at probing nvhdmi-mcp driver After restructuring and splitting the HDMI codec driver code, each HDMI codec driver contains the own buildcontrols and buildpcms ops. A copy-n-paste error put the wrong...

CVE-2025-40350

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix generating skb from non-linear xdpbuff for striding RQ XDP programs can change the layout of an xdpbuff through bpfxdpadjusttail and bpfxdpadjusthead. Therefore, the driver cannot assume the size of the linear...

UBUNTU-CVE-2025-68205

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/hdmi: Fix breakage at probing nvhdmi-mcp driver After restructuring and splitting the HDMI codec driver code, each HDMI codec driver contains the own buildcontrols and buildpcms ops. A copy-n-paste error put the wrong...

CVE-2025-68205

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/hdmi: Fix breakage at probing nvhdmi-mcp driver After restructuring and splitting the HDMI codec driver code, each HDMI codec driver contains the own buildcontrols and buildpcms ops. A copy-n-paste error put the wrong...

CVE-2025-68205 ALSA: hda/hdmi: Fix breakage at probing nvhdmi-mcp driver

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/hdmi: Fix breakage at probing nvhdmi-mcp driver After restructuring and splitting the HDMI codec driver code, each HDMI codec driver contains the own buildcontrols and buildpcms ops. A copy-n-paste error put the wrong...

CVE-2025-68205 ALSA: hda/hdmi: Fix breakage at probing nvhdmi-mcp driver

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/hdmi: Fix breakage at probing nvhdmi-mcp driver After restructuring and splitting the HDMI codec driver code, each HDMI codec driver contains the own buildcontrols and buildpcms ops. A copy-n-paste error put the wrong...

CVE-2025-62847

An improper neutralization of argument delimiters in a command vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to alter execution logic. We have already fixed the vulnerability in the following versions: QTS...

CVE-2025-59385

The CVE-2025-59385 issue is an authentication bypass by spoofing affecting QNAP QTS and QuTS hero OSes. The vulnerability could allow remote attackers to access restricted resources. Fixed in QTS 5.2.7.3297 (build 20251024) and QuTS hero h5.2.7.3297 (build 20251024) as well as h5.3.1.3292 (build ...

EUVD-2025-203490

An improper neutralization of argument delimiters in a command vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to alter execution logic. We have already fixed the vulnerability in the following versions: QTS...

CVE-2025-62848

CVE-2025-62848 is a NULL pointer dereference vulnerability reported affecting multiple QNAP platforms (QTS and QuTS hero). The issue allows remote attackers to trigger a denial-of-service via network access, as described in vendor notes. Affected versions have been patched in QTS 5.2.7.3297 build...

PT-2025-53775

Name of the Vulnerable Software and Affected Versions NagiosXI version 2026R1.0.1 build 1762361101 Description Dashboard parameters in the software do not have sufficient filtering, which allows authenticated users to exploit a SQL Injection issue. The vulnerability allows unauthorized access to...

PT-2025-51618

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's ALSA subsystem, specifically within the HDMI codec driver code related to the nvhdmi-mcp driver. A copy-and-paste error swapped the build controls and...

Sensitive Information Exposure

Jenkins ByteGuard Build Actions Plugin is vulnerable to sensitive information exposure. The vulnerability is due to improper masking of API tokens on the job configuration form, which allows an attacker to observe and capture these tokens...

Cross-site Scripting (XSS)

Jenkins Applitools Eyes Plugin is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the plugin not escaping the Applitools URL on the build page, where attackers with Item/Configure permission can exploit it to inject malicious scripts...

Authorization Bypass

Jenkins global-build-stats Plugin is vulnerable to Authorization Bypass. The vulnerability is due to missing permission checks in REST API endpoints, where the plugin exposes graph-related APIs without validating the caller’s authorization, and allows attackers with Overall/Read permission to...

Cross Site Scripting

Jenkins Spring Config Plugin is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper escaping of build display names in the Spring Config view, allowing attackers who can modify build display names to inject malicious scripts that execute in other users' browsers...