CVE-2025-12559

Mattermost suffers an information-disclosure vulnerability CVE-2025-12559 where certain versions are not sanitizing team email addresses. Affected: Mattermost Server 11.0.x <= 11.0.2; 10.12.x <= 10.12.1; 10.11.x <= 10.11.4; 10.5.x

CVE-2025-12559 Information Disclosure in Common Teams API

Mattermost versions 11.0.x = 11.0.2, 10.12.x = 10.12.1, 10.11.x = 10.11.4, 10.5.x = 10.5.12 fail to sanitize team email addresses to be visible only to Team Admins, which allows any authenticated user to view team email addresses via the GET /api/v4/channels/channelid/commonteams endpoint...

CVE-2025-12559 Information Disclosure in Common Teams API

Mattermost versions 11.0.x = 11.0.2, 10.12.x = 10.12.1, 10.11.x = 10.11.4, 10.5.x = 10.5.12 fail to sanitize team email addresses to be visible only to Team Admins, which allows any authenticated user to view team email addresses via the GET /api/v4/channels/channelid/commonteams endpoint...

CVE-2025-12559 Information Disclosure in Common Teams API

Mattermost versions 11.0.x = 11.0.2, 10.12.x = 10.12.1, 10.11.x = 10.11.4, 10.5.x = 10.5.12 fail to sanitize team email addresses to be visible only to Team Admins, which allows any authenticated user to view team email addresses via the GET /api/v4/channels/channelid/commonteams endpoint...

CVE-2025-8890

creationtimestamp| type| source ---|---|--- 2025-11-27 15:28:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m6moorbxdg2s 2025-11-28 01:04:23+00:00| seen| https://infosec.exchange/users/offseq/statuses/115624631470875781 2025-11-28 01:04:26+00:00| seen|...

4science_ng-dynamic-forms (>=19.0.0 <=19.0.3), @27richie/npm-test-richie (>=0.0.0 <=1.0.6) +5054 more potentially affected by CVE-2025-66035 via @angular/common (>=0.0.0-0 <=19.2.15)

@angular/common NPM version =0.0.0-0, =19.0.0, =0.0.0, =0.2.0, =3.0.2, =3.0.3 - @aakashsuryawanshi/ng-idle =1.0.0 - @aalsi/ap-lib-demo =0.0.3-SNAPSHOT - @abaza738/angular-editor =1.0.0 - @abdos/ngx-tinzert =0.0.0 - @abdullk00138/watch-list =1.0.0 - @abdullk00138/webui =1.0.2 -...

Incorrect Authorization

Overview @oneuptime/common is a The OneUptime Common UI Library is a collection of shared components, utilities that are used across the OneUptime platform. It is designed to be easy to install and use, and to be extensible. This library is built with React and TypeScript. It includes c Affected...

DEBIAN-CVE-2025-63938

Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the stripreturnport function within src/reqs.c...

io.github.linghengqian:hive-server2-jdbc-driver-thin (=2.0.0), nl.basjes.parse.useragent:yauaa-hive (=7.32.0) +32 more potentially affected by CVE-2025-62728 via org.apache.hive:hive-common (=4.1.0)

org.apache.hive:hive-common MAVEN version =4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-common and may be impacted: - io.github.linghengqian:hive-server2-jdbc-driver-thin =2.0.0 - nl.basjes.parse.useragent:yauaa-hive =7.32...

Incorrect Authorization

Overview @oneuptime/common is a The OneUptime Common UI Library is a collection of shared components, utilities that are used across the OneUptime platform. It is designed to be easy to install and use, and to be extensible. This library is built with React and TypeScript. It includes c Affected...

SUSE-SU-2025:4229-1 Security update for buildah

This update for buildah fixes the following issues: - CVE-2025-47913: Fixed a bug in the client process termination when receiving an unexpected message type in response to a key listing or signing request. bsc1253598...

CVE-2025-64730

creationtimestamp| type| source ---|---|--- 2025-11-25 08:21:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m6gvvw66fw2s...

CVE-2025-54563

creationtimestamp| type| source ---|---|--- 2025-11-25 01:40:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m6g7ib253v2k...

Malicious code in @voiceflow/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c31b6225a913c42ff3e119872d881af1992d5de51a2cf9632f3c055a8fd577c9 The package @voiceflow/common was found to contain malicious code. Source: ghsa-malware...

Malicious code in @voiceflow/test-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f63a9f42565b5107e8f6684e1079874b29df133cb9d0bb1f425adf7317a6a50 The package @voiceflow/test-common was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199422

Malicious code in @voiceflow/common npm...

MAL-2025-191357 Malicious code in @voiceflow/nestjs-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6d3635e3e4ea7fe67bd91fc10dbb52d16b29a74193117747292587c6fd1d5ef The package @voiceflow/nestjs-common was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191340 Malicious code in @voiceflow/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c31b6225a913c42ff3e119872d881af1992d5de51a2cf9632f3c055a8fd577c9 The package @voiceflow/common was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199405

Malicious code in @voiceflow/nestjs-common npm...

Oracle Linux 8 : libssh (ELSA-2025-21977)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-21977 advisory. 0.9.6-16 - Fix CVE-2025-5372 Resolves: RHEL-121232 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...