CVE-2025-30177

A flaw was found in the Apache Camel Undertow component. This vulnerability allows an attacker to inject Camel-specific headers via the inbound request, which can alter the behavior of certain Camel components such as camel-bean and camel-exec. This issue occurs due to the custom header filter...

WordPress Secure Copy Content Protection and Content Locking plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by astra.r3verii in WordPress Plugin Secure Copy Content Protection and Content Locking versions = 4.4.3...

CVE-2025-27427

A flaw was found in Apache ActiveMQ Artemis. This vulnerability allows a user with createDurableQueue or createNonDurableQueue permissions to augment the routing-type of an address without the createAddress permission. When combined with the send permission and automatic queue creation, an attack...

Security Bulletin: IBM Storage Protect Server is susceptible to vulnerability in Golang Go (CVE-2024-34158, CVE-2024-34155, CVE-2024-34156).

Summary Golang Go is used by the IBM Storage Protect Server OSSM component and is affected by multiple vulnerabilities that could lead to a denial-of-service DoS attack on the host system. This bulletin provides the necessary steps to mitigate these vulnerabilities. Vulnerability Details...

openSUSE Security Advisory (openSUSE-SU-2025:0110-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-14048 · Unknown · Greek Multi Tool

Name of the Vulnerable Software and Affected Versions: Greek Multi Tool – Fix peralinks, accents, auto create menus and more versions prior to 2.3.1 Description: The issue is related to Missing Authorization, allowing exploitation of incorrectly configured access control security levels...

WordPress Booster for WooCommerce plugin <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Booster for WooCommerce versions = 7.2.4...

CVE-2025-31124 Zitadel allows User Enumeration by loginname attribute normalization

Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report...

CVE-2025-31124

CVE-2025-31124 (Zitadel) describes a user enumeration flaw in the login flow caused by normalization of the username when the “Ignoring unknown usernames” setting is enabled. Although the UI prompts for a password and returns “Username or Password invalid” for non-existent users, the normalizatio...

WordPress YayExtra <= 1.5.2 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by theviper17 Patchstack Alliance in WordPress Plugin YayExtra versions = 1.5.2...

CGA-JQ94-4MVQ-GXQ6

Bulletin has no description...

CGA-J5XC-33W9-XG7P

Bulletin has no description...

CGA-3MG7-8QP4-V6XM

Bulletin has no description...

CVE-2025-30095

VyOS 1.3 through 1.5 fixed in 1.4.2 or any Debian-based system using dropbear in combination with live-build has the same Dropbear private host keys across different installations. Thus, an attacker can conduct active man-in-the-middle attacks against SSH connections if Dropbear is enabled as the...

CVE-2025-2953

A flaw was found in PyTorch. This vulnerability allows denial of service via local exploitation. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability t...

CVE-2025-1861

A flaw was found in PHP. This vulnerability allows incorrect URL truncation and redirection to the wrong location via HTTP redirect handling due to a limited location buffer size. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red H...

CVE-2025-1736

A flaw was found in PHP. This vulnerability allows certain headers to be either not sent or misinterpreted due to insufficient validation of the end-of-line characters via user-supplied headers. Mitigation Mitigation for this issue is either not available or the currently available options do not...

CVE-2025-1734

A flaw was found in PHP. This vulnerability allows applications to accept invalid headers via malformed HTTP headers missing a colon :, which may confuse applications into processing them as valid headers. Mitigation Mitigation for this issue is either not available or the currently available...

CVE-2025-1219

A flaw was found in PHP's DOM and SimpleXML extensions. This vulnerability allows incorrect parsing of a redirected HTTP resource via improper content-type header handling. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

Backdoor in the Backplane. Doing IPMI security better

TL;DR IPMI, released by Intel in 1998, is a hardware management interface operating independently of the OS, often using 623/udp. It monitors hardware data e.g., temperature, power and supports remote recovery, integrated into BMCs like HP iLO, Dell DRAC, and others. IPMI vulnerabilities include...