Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2025-8692

CVE-2025-8692 affects the Coupon API plugin for WordPress (versions up to 6.2.9). An authenticated attacker with Administrator+ privileges can exploit SQL Injection via the log_duration parameter to append additional SQL queries and potentially exfiltrate data. Remediation per Patchstack and rela...

Oracle Linux 9 : kernel (ELSA-2025-15429)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-15429 advisory. - udmabuf: fix a buf size overflow issue during udmabuf creation CKI Backport Bot RHEL-99746 CVE-2025-37803 Tenable has extracted the preceding...

CVE-2025-58365

The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Prior to version 9.14, the blog application in XWiki allowed remote code execution for any user who has edit right on any page. Normally, these are all logged-in users as they can edit their own user...

CVE-2025-59049 Mockoon has a Path Traversal and LFI in the static file serving endpoint

Mockoon provides way to design and run mock APIs. Prior to version 9.2.0, a mock API configuration for static file serving follows the same approach presented in the documentation page, where the server filename is generated via templating features from user input is vulnerable to Path Traversal...

WordPress XStore theme < 9.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Theme XStore versions 9.6...

CVE-2025-8388

The PowerPack Elementor Addons Free Widgets, Extensions and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cursorurl’ parameter in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-8388 PowerPack Lite for Elementor <= 2.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Via 'cursor_url'

The PowerPack Elementor Addons Free Widgets, Extensions and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cursorurl’ parameter in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for...

Linux Distros Unpatched Vulnerability : CVE-2015-5791

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service...

Linux Distros Unpatched Vulnerability : CVE-2019-16688

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr 9.0.5 has stored XSS in an Email Template section to mailstemplates.php. A user with no privileges can inject script to attack the admin. This stored X...

RHEL 9 : python3.12-cryptography (RHSA-2025:15608)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:15608 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

Linux Distros Unpatched Vulnerability : CVE-2016-3873

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The NVIDIA kernel in Android before 2016-09-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 29518457...

Linux Distros Unpatched Vulnerability : CVE-2019-16687

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr 9.0.5 has stored XSS in a User Profile in a Signature section to card.php. A user with the Create/modify other users, groups and permissions privilege...

Linux Distros Unpatched Vulnerability : CVE-2019-2137

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the endCall function of TelecomManager.java, there is a possible Denial of Service due to a missing permission check. This could lead to local denial of acce...

Linux Distros Unpatched Vulnerability : CVE-2019-11200

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file. However, the application performs insufficient chec...

Linux Distros Unpatched Vulnerability : CVE-2025-23046

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a Mail servers authentication provider is...

Linux Distros Unpatched Vulnerability : CVE-2015-5825

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive information...

Mockoon 安全漏洞

Mockoon is an interface software of mockoon open source. A security vulnerability exists in Mockoon versions prior to 9.2.0 that stems from a path traversal and local file inclusion vulnerability in the static file service configuration...

PT-2025-37051

Name of the Vulnerable Software and Affected Versions: HuangDou UTCMS version 9 Description: A critical issue exists in HuangDou UTCMS version 9 related to SQL injection. The vulnerability affects the RunSql function within the app/modules/ut-data/admin/mysql.php file. Manipulation of the sql...

Linux Distros Unpatched Vulnerability : CVE-2019-16685

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr 9.0.5 has stored XSS vulnerability via a User Group Description section to card.php. A user with the Create/modify other users, groups and permissions...