Fedora 42 : screen (2025-f055a0d751)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-f055a0d751 advisory. Update default config options for build. ---- New upstream release 5.0.1 Tenable has extracted the preceding description block directly from the...

Fedora 41 : screen (2025-653690f2f7)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-653690f2f7 advisory. Update default config options for build. ---- New upstream release 5.0.1 Tenable has extracted the preceding description block directly from the...

CVE-2025-54310

A local file access flaw has been discovered in qBittorrent. This flaw may allow access to local files when a web page should be expected. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising...

CVE-2025-53901

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder. The specific bug is triggered by calling pathopen after calling...

CVE-2025-53964

A flaw was found in GoldenDict. The application allows reading and modification of arbitrary files when a user adds a specially crafted dictionary and subsequently performs a search. This vulnerability allows a network attacker with user interaction to potentially manipulate files on the system...

CVE-2025-6053: Cross-Site Request Forgery (CSRF)

The Zuppler Online Ordering plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.0. This is due to missing or incorrect nonce validation on the 'zuppler-online-ordering-options' page. This makes it possible for unauthenticated attackers to...

CVE-2025-53817

7-Zip is a file archiver with a high compression ratio. 7-Zip supports extracting from Compound Documents. Prior to version 25.0.0, a null pointer dereference in the Compound handler may lead to denial of service. Version 25.0.0 contains a fix cor the issue. Mitigation Mitigation for this issue i...

CVE-2025-40924

A session id generation flaw has been discovered in the Catalyst::Plugin::Session Perl module. The session id is generated from a hash usually SHA-1 of a simple counter, the epoch time, the built-in rand function, the PID, and the current Catalyst context. This information is of low entropy. The...

CVE-2025-27465

A flaw was found in Xen. Xen’s emulation of intercepted instructions uses replay mechanisms with executable stubs. Improper handling of exceptions raised during this replay process allows a local attacker to trigger unexpected behavior. This issue can occur when an instruction causes an exception...

CVE-2025-40919

Authen::DigestMD5 versions 0.01 through 0.02 for Perl generate the cnonce insecurely. The cnonce client nonce is generated from an MD5 hash of the PID, the epoch time and the built-in rand function. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not...

CVE-2025-40923

A random session id generation flaw has been discovered in Plack-Middleware-Session. By default, session ids are generated by a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed if it is...

CVE-2025-40776 Birthday Attack against Resolvers supporting ECS

A named caching resolver that is configured to send ECS EDNS Client Subnet options may be vulnerable to a cache-poisoning attack. This issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1...

CVE-2025-40776

CVE-2025-40776 affects ISC BIND named caching resolvers that are configured to send EDNS Client Subnet (ECS) options. The vulnerability is a potential cache-poisoning issue in the resolver when ECS is present. Affected BIND 9 versions are 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S...

CVE-2025-40776

A "named" caching resolver that is configured to send ECS EDNS Client Subnet options may be vulnerable to a cache-poisoning attack. This issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1...

CVE-2025-40776

A named caching resolver that is configured to send ECS EDNS Client Subnet options may be vulnerable to a cache-poisoning attack. This issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1...

PT-2025-33596

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A memory leak exists in the efivarfs filesystem when processing mount options. Specifically, the efivarfs fs info structure is allocated early during filesystem context initialization...

PT-2025-33573

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A flaw exists in the Linux kernel’s comedi subsystem, specifically within the pcl812 driver. An unchecked integer value, it-options1, received from userspace, can lead to a bit shift...

CVE-2025-50098

A denial of service flaw was found in MySQL. This flaw allows a privileged attacker with network access via multiple protocols to cause a crash in the MySQL server...

CVE-2025-50096

A denial of service flaw was found in MySQL. This flaw allows a privileged attacker with log-on access to the infrastructure where MySQL Server runs to cause a crash in the MySQL server...

CVE-2025-53906

A path traversal flaw was found in Vim. Successful exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. Mitigation Mitigation for this issue is either not available or the currentl...