Medium: php8.2

Issue Overview: Header parser of http stream wrapper does not handle folded headers. CVE-2025-1217 When requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. CVE-2025-1219...

Medium: php8.2

Issue Overview: Header parser of http stream wrapper does not handle folded headers. CVE-2025-1217 When requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. CVE-2025-1219...

OPENSUSE-SU-2025:14991-1 libsqlite3-0-3.49.1-3.1 on GA media

These are all security issues fixed in the libsqlite3-0-3.49.1-3.1 package on the GA media of openSUSE Tumbleweed...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2025-927)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-927 advisory. PDF interpreter - Guard against unsigned int overflow. A large Type 4 function definition can overflow the uint counter, causing the allocated buffer to be smaller than required. Info:...

OPENSUSE-SU-2025:14989-1 flannel-0.26.6-1.1 on GA media

These are all security issues fixed in the flannel-0.26.6-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:14990-1 rekor-1.3.10-1.1 on GA media

These are all security issues fixed in the rekor-1.3.10-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:14992-1 libvarnishapi3-7.7.0-1.1 on GA media

These are all security issues fixed in the libvarnishapi3-7.7.0-1.1 package on the GA media of openSUSE Tumbleweed...

[SECURITY] [DSA 5901-1] mediawiki security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5901-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 13, 2025 https://www.debian.org/security/faq -...

CVE-2025-3434

The SMTP for Amazon SES – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Logs in all versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2025-16176 · Undefined · Undefined

Security audit of PHP https://t.co/Tl4FK62NVP 2 high, 6 medium, 9 low severity, and 10 informative issues. 4 CVEs, 3 of them public and fixed last year, 1 not yet fully public: CVE-2024-8928: Memory-related vulnerability in PHP's filter handling, leading to segmentation faults...

CVE-2025-24866

Mattermost versions 9.11.x = 9.11.8 fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated granular administration roles who lack access to Compliance Monitoring to retrieve User Activity Logs...

CVE-2025-32387 vulnerabilities

Vulnerabilities for packages: kots, cilium-cli, consul-k8s, consul-k8s-fips, kuma, kubescape, chartmuseum-fips, tw, zot, flux-source-controller-fips, flux-fips, helm-docs, k9s, harbor-fips, cluster-api-helm-controller-fips, pluto, rancher-helm, cert-manager-cmctl-fips, flux-source-controller,...

CGA-HXX2-6CGR-6G38

Bulletin has no description...

CVE-2025-26479

Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.0, contains an out-of-bounds write vulnerability. An attacker could potentially exploit this vulnerability in NFS workflows, leading to data integrity issues...

Advisory ROSA-SA-2025-2850

Software: libX11 1.6.8 OS: ROSA Virtualization 2.1 packageevrstring: libX11-1.6.8-9.0.1.rv3 CVE-ID: CVE-2020-14344 BDU-ID: 2020-03916 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the X Window System libX11 client API provisioning library is caused by an integer overflow. Exploitation of the...

Advisory ROSA-SA-2025-2818

Software: rsync 3.1.3 OS: ROSA Virtualization 3.0 packageevrstring: rsync-3.1.3-21.rv30 CVE-ID: CVE-2024-12087 BDU-ID: 2025-00377 CVE-Crit: HIGH CVE-DESC.: A configuration vulnerability in the --inc-recursive configuration of the rsyncd daemon of the Rsync file transfer and synchronization utilit...

Advisory ROSA-SA-2025-2812

Software: mariadb 10.5.27 OS: ROSA Virtualization 3.0 packageevrstring: mariadb-10.5.27-1.rv30 CVE-ID: CVE-2023-22084 BDU-ID: 2023-06913 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the InnoDB component of the MySQL Server database management system is related to insufficient input validation...

Advisory ROSA-SA-2025-2797

Software: expat 2.2.5 OS: ROSA Virtualization 3.0 packageevrstring: expat-2.2.5-16.0.1.rv30 CVE-ID: CVE-2022-23990 BDU-ID: 2022-00999 CVE-Crit: CRITICAL CVE-DESC.: A vulnerability in the doProlog function of the Expat library is related to integer overflow. Exploitation of the vulnerability could...

SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)

SurrealDB offers http functions that can access external network endpoints. A typical, albeit not recommended configuration would be to start SurrealDB with all network connections allowed with the exception of a deny list. For example, surreal start --allow-net --deny-net 10.0.0.0/8 will allow a...

CVE-2025-32395

A flaw was found in Vite. This vulnerability allows arbitrary file access via specially crafted HTTP requests containing a character in the request URL. The issue occurs when the server is run on Node.js or Bun and exposed to the network. Improper handling of invalid request lines allows these...