PT-2025-30011 · Joomla · Articles Calendar

Name of the Vulnerable Software and Affected Versions: Articles Calendar versions 1.0.0 through 1.0.1.0007 Description: A SQL injection issue exists in the Articles Calendar extension for Joomla. This allows attackers to execute arbitrary SQL commands. Recommendations: Update Articles Calendar to...

Balbooa Gallery 跨站脚本漏洞

Balbooa Gallery is a Joomla extension from Balbooa Inc. A cross-site scripting vulnerability exists in Balbooa Gallery versions 1.0.0-2.4.0, which stems from a stored cross-site scripting attack...

Balbooa Forms SQL注入漏洞

Balbooa Forms is a Joomla extension from Balbooa Inc. A SQL injection vulnerability exists in Balbooa Forms versions 1.0.0-2.3.1.1, which stems from an incorrect manipulation of the parameter id leading to a SQL injection attack...

DEBIAN-CVE-2025-5994

A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet ECS. Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to...

CVE-2025-5284

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS extension in all versions up to, and including, 2.0.8.2 due to insufficient capability restriction, and...

BIT-PHP-MIN-2025-6491 NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. before 8.4.10 when parsing XML data in SOAP extensions, overly large 2Gb XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server...

BIT-PHP-2025-6491 NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. before 8.4.10 when parsing XML data in SOAP extensions, overly large 2Gb XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server...

BIT-PHP-2025-1735 pgsql extension does not check for errors during escaping

In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. pgsql and pdopgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid...

NLnet Unbound 安全漏洞

NLnet Unbound is an open source DNS server from the Dutch NLnet team. A security vulnerability exists in NLnet Unbound that stems from a risk of cache poisoning when supporting EDNS Client Subnet, which could lead to a Rebirthday attack...

kernel: Squashfs: fix handling and sanity checking of xattr_ids count

In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix handling and sanity checking of xattrids count A Sysbot 1 corrupted filesystem exposes two flaws in the handling and sanity checking of the xattrids count in the filesystem. Both of these flaws cause computation...

@bicou/directus-extension-imagga (>=1.6.3, <=1.6.6), @directus/api (>=20.0.0-rc.0, <=27.1.0) potentially affected by CVE-2025-53889 via directus (>=11.0.0, <=11.8.0)

directus NPM version =11.0.0, =1.6.3, =20.0.0-rc.0, =27.1.0 Source cves: CVE-2025-53889 Source advisory: OSV:GHSA-7CVF-PXGP-42FC...

Gnutls: vulnerability in gnutls sct extension parsing

...

CVE-2025-53623

The Job Iteration API is an an extension for ActiveJob that make jobs interruptible and resumable Versions prior to 1.11.0 have an arbitrary code execution vulnerability in the CsvEnumerator class. This vulnerability can be exploited by an attacker to execute arbitrary commands on the system wher...

Security update for the Linux Kernel

This update provides the initial livepatch for this kernel update. This update does not contain any fixes and will be updated with livepatches later. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE update use the SUSE...

kernel: Squashfs: fix handling and sanity checking of xattr_ids count

In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix handling and sanity checking of xattrids count A Sysbot 1 corrupted filesystem exposes two flaws in the handling and sanity checking of the xattrids count in the filesystem. Both of these flaws cause computation...

CVE-2025-27582

The Secure Password extension in One Identity Password Manager before 5.14.4 allows local privilege escalation. The issue arises from a flawed security hardening mechanism within the kiosk browser used to display the Password Self-Service site to end users. Specifically, the application attempts ...

The vulnerability of the MPEG-2 Video Extension codec in Microsoft Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the MPEG-2 Video Extension codec in Microsoft Windows operating systems is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

One Identity Password Manager 安全漏洞

One Identity Password Manager is a web platform for providing authentication from One Identity, Inc. in the United States. A security vulnerability exists in One Identity Password Manager versions prior to 5.14.4, which stems from a flaw in the security hardening mechanism in the Secure Password...

DM-RSA: an Extension of RSA with Dual Modulus

We introduce DM-RSA Dual Modulus RSA, a variant of the RSA cryptosystem that employs two distinct moduli symmetrically to enhance security. By leveraging the Chinese Remainder Theorem CRT for decryption, DM-RSA provides increased robustness against side-channel attacks while preserving the...

CVE-2025-1735

In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. pgsql and pdopgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid...