RHEL 8 : expat (RHSA-2025:21776)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:21776 advisory. Expat is a C library for parsing XML documents. Security Fixes: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocation...

WordPress plugin Directorist 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

Emby Server < 4.8.1.0 XSS Vulnerability

Emby Server is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

RockyLinux 8 : lasso (RLSA-2025:21628)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:21628 advisory. lasso: Type confusion in Entr'ouvert Lasso CVE-2025-47151 Tenable has extracted the preceding description block directly from the RockyLinux security advisory...

AlmaLinux 8 : lasso (ALSA-2025:21628)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:21628 advisory. lasso: Type confusion in Entr'ouvert Lasso CVE-2025-47151 Tenable has extracted the preceding description block directly from the AlmaLinux security advisory. Not...

RHEL 8 : bind (RHSA-2025:21736)

"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:21736 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named %NASLMINLEVEL...

PT-2025-47448

A improper neutralization of script-related html tags in a web page basic xss vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 through 7.6.3, FortiADC 7.4 all versions, FortiADC 7.2 all versions may allow attacker to execute unauthorized code or commands via crafted URL...

PT-2025-47488

Name of the Vulnerable Software and Affected Versions Astro versions prior to 5.15.8 Description A reflected cross-site scripting XSS issue exists in Astro when the server islands feature is utilized. The issue affects applications using the server islands feature, regardless of the component...

PT-2026-2324

Name of the Vulnerable Software and Affected Versions libpng versions 1.6.51 through 1.6.53 Description libpng is a library used by applications to read, create, and manipulate PNG image files. A heap buffer over-read exists in the png image finish read function when processing interlaced 16-bit...

CVE-2025-64325

Emby Server is a personal media server. Prior to version 4.8.1.0 and prior to Beta version 4.9.0.0-beta, a malicious user can send an authentication request with a manipulated X-Emby-Client value, which gets added to the devices section of the admin dashboard without sanitization. This issue has...

CVE-2025-64325 Emby Server is Vulnerable to Remote Code Execution Through XSS in Admin Dashboard

Emby Server is a personal media server. Prior to version 4.8.1.0 and prior to Beta version 4.9.0.0-beta, a malicious user can send an authentication request with a manipulated X-Emby-Client value, which gets added to the devices section of the admin dashboard without sanitization. This issue has...

EUVD-2025-198072

In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating invite requests...

CVE-2025-36118

IBM Storage Virtualize 8.4, 8.5, 8.7, and 9.1 IKEv1 implementation allows remote attackers to obtain sensitive information from device memory via a Security Association SA negotiation request...

Drupal core allows Content Spoofing

User Interface UI Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8...

lasso security update

An update is available for lasso. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The lasso packages provide the Lasso library that implements the Liberty Allian...

Ascertia SigningHub 安全漏洞

Ascertia SigningHub is an electronic signature software from Ascertia UK. A security vulnerability exists in Ascertia SigningHub version 8.6.8 and prior versions, which stems from a lack of rate limiting in the reset password function and could lead to email bombing...

Oracle Linux 8 : kernel (ELSA-2025-21398)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-21398 advisory. - vsock/virtio: Validate length in packet header before skbput Jon Maloy RHEL-114296 CVE-2025-39718 Tenable has extracted the preceding description block...

HCL Connections 安全漏洞

HCL Connections is a suite of enterprise collaboration platforms from HCL India. A security vulnerability exists in HCL Connections version 8.0, which stems from improper rendering of application data and could lead to disclosure of sensitive information...

CVE-2025-64076

Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decodedefinitelongstring function of the C extension decoder source/decoder.c: 1 Integer Underflow Leading to Out-of-Bounds Read CWE-191, CWE-125: An incorrect variable reference and missing state reset in the chunk processing...

WordPress plugin AI Engine 代码问题漏洞

WordPress AI Engine plugin is a WordPress plugin that is mainly used to integrate OpenAI's ChatGPT, MicrosoftAzure and other AI services into a WordPress website, providing chatbots, content generation, image generation and other features. The WordPress AI Engine plugin suffers from a server-side...