CVE-2026-25499 terraform-provider-proxmox has insecure sudo recommendation in the documentation

Terraform / OpenTofu Provider adds support for Proxmox Virtual Environment. Prior to version 0.93.1, in the SSH configuration documentation, the sudoer line suggested is insecure and can result in escaping the folder using ../, allowing any files on the system to be edited. This issue has been...

CVE-2026-25499

CVE-2026-25499 affects the Terraform/OpenTofu Provider for Proxmox. Before version 0.93.1, SSH configuration documentation suggested an insecure sudoer line that could allow escaping the working directory via ../, enabling modification of arbitrary files on the system. This vulnerability has been...

PT-2026-6309

Name of the Vulnerable Software and Affected Versions OpenSlides versions prior to 4.2.29 Description OpenSlides is a web-based presentation and assembly system. Prior to version 4.2.29, a flaw exists in access control for users synchronized via an external IDP, allowing local logins with a trivi...

Improper Handling of Insufficient Permissions or Privileges

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Improper Handling of Insufficient Permissions or Privileges via the LTI Provider available to suspended users. An attacker can gain unauthorized access to the system and perform actions or access...

CVE-2025-67848

A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools Interoperability LTI Provider. The issue arises from the LTI authentication handlers failing to enforce the user's suspension status, enabling unauthorized access...

Improper TLS Certificate Validation

github.com/neuvector/neuvector is vulnerable to improper TLS certificate validation. The vulnerability is due to TLS verification not being enforced by default for OpenID Connect authentication, which allows an attacker to perform man-in-the-middle MITM attacks by intercepting or tampering with...

Notepad++ Hosting Breach Attributed to China-Linked Lotus Blossom Hacking Group

A China-linked threat actor known as Lotus Blossom has been attributed with medium confidence to the recently discovered compromise of the infrastructure hosting Notepad++. The attack enabled the state-sponsored hacking group to deliver a previously undocumented backdoor codenamed Chrysalis to...

GHSA-GWCH-7M8V-7544 terraform-provider-proxmox has insecure sudo recommendation in the documentation

Note: It is uncertain whether this constitutes a vulnerability or should be filed as an issue instead. Summary In the SSH configuration documentation, the sudoer line that was suggested can be escalated to edit any files in the system. Details The following line were suggested for addition in the...

Notepad++ Updates Delivered Malware After Hosting Provider Breach

A months-long breach allowed Chinese State-sponsored hackers to hijack Notepad++ updates in 2025, exposing users to malware via a compromised hosting provider...

Notepad++ Official Update Mechanism Hijacked to Deliver Malware to Select Users

The maintainer of Notepad++ has revealed that state-sponsored attackers hijacked the utility's update mechanism to redirect update traffic to malicious servers instead. "The attack involved an infrastructure-level compromise that allowed malicious actors to intercept and redirect update traffic...

PT-2026-6295

Name of the Vulnerable Software and Affected Versions Terraform / OpenTofu Provider versions prior to 0.93.1 Description The Terraform / OpenTofu Provider for Proxmox Virtual Environment, prior to version 0.93.1, contains an insecure sudoer line in its SSH configuration documentation. This...

CVE-2026-25499

creationtimestamp| type| source ---|---|--- 2026-01-31 17:32:06+00:00| published-proof-of-concept| https://github.com/bpg/terraform-provider-proxmox/security/advisories/GHSA-gwch-7m8v-7544...

CVE-2025-61726 vulnerabilities

Vulnerabilities for packages: kubescape-operator, descheduler, grafana-operator, nerdctl, sbom-convert, kine, amazon-cloudwatch-agent-operator, postgres-operator, sealed-secrets, terraform-provider-pagerduty, kor, headlamp, kubeflow-pipelines, nats-top, spqr, src, litestream,...

CVE-2025-68119 vulnerabilities

Vulnerabilities for packages: nerdctl, mockgen, kor, spqr, litestream, sops, flux-notification-controller, aws-sigv4-proxy, nri-nagios, chisel, doppler-kubernetes-operator, gogatekeeper, crossplane-provider-family-aws, aws-flb-cloudwatch, nri-haproxy, go-licenses, rancher-system-upgrade-controlle...

GHSA-XVQR-69V8-F3GV vulnerabilities

Vulnerabilities for packages: nerdctl, mockgen, kor, spqr, litestream, sops, flux-notification-controller, aws-sigv4-proxy, nri-nagios, chisel, doppler-kubernetes-operator, gogatekeeper, crossplane-provider-family-aws, aws-flb-cloudwatch, nri-haproxy, go-licenses, rancher-system-upgrade-controlle...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: kubescape-operator, descheduler, grafana-operator, nerdctl, kine, amazon-cloudwatch-agent-operator, postgres-operator, sealed-secrets, terraform-provider-pagerduty, kor, headlamp, kubeflow-pipelines, nats-top, spqr, src, litestream, nri-couchbase,...

GHSA-CM6P-QC7V-M3JW vulnerabilities

Vulnerabilities for packages: nerdctl, mockgen, kor, spqr, litestream, sops, flux-notification-controller, aws-sigv4-proxy, nri-nagios, chisel, doppler-kubernetes-operator, gogatekeeper, crossplane-provider-family-aws, aws-flb-cloudwatch, nri-haproxy, go-licenses, rancher-system-upgrade-controlle...

GHSA-GM9R-Q53W-2GH4 vulnerabilities

Vulnerabilities for packages: kubescape-operator, descheduler, grafana-operator, nerdctl, sbom-convert, kine, amazon-cloudwatch-agent-operator, postgres-operator, sealed-secrets, terraform-provider-pagerduty, kor, headlamp, kubeflow-pipelines, nats-top, spqr, src, litestream,...

CVE-2025-61730 vulnerabilities

Vulnerabilities for packages: descheduler-fips, secrets-store-csi-driver-provider-aws-fips, crossplane-provider-aws-ec2, prometheus-nats-exporter, crossplane-provider-kubernetes-fips, git-sync-fips, sealed-secrets, keda-fips, prometheus-elasticsearch-exporter-fips, cluster-api,...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: descheduler-fips, secrets-store-csi-driver-provider-aws-fips, crossplane-provider-aws-ec2, prometheus-nats-exporter, crossplane-provider-kubernetes-fips, git-sync-fips, sealed-secrets, keda-fips, prometheus-elasticsearch-exporter-fips, cluster-api,...