CVE-2025-55013

The CVE-2025-55013 issue affects Assemblyline 4 Service Client. The task_handler.py component accepts a SHA-256 value from the server and uses it directly as a local filename, enabling a path traversal when the server (or a MITM) returns a payload like ../../../etc/cron.d/evil. This can cause the...

OESA-2025-1978 libtiff security update

This provides support for the Tag Image File Format TIFF, a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff...

Security update for dpkg

This update for dpkg fixes the following issues: CVE-2025-6297: Fixed an improper sanitization of directory permissions that could lead to DoS. bsc1245573 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

CVE-2025-51532

Incorrect access control in Sage DPW 202412004 and earlier allows unauthorized attackers to access the built-in Database Monitor via a crafted request. The vendor has stated that the issue is fixed in 202506000, released in June 2025...

Important Photon OS Security Update - PHSA-2025-4.0-0848

Updates of 'libtiff' packages of Photon OS have been released...

PT-2026-23871

Name of the Vulnerable Software and Affected Versions Netmaker versions prior to 1.5.0 Description Netmaker, a networking tool utilizing WireGuard, contains an issue where a user with the platform-user role can access WireGuard private keys for all configurations within a network. This occurs...

PT-2026-23868

Name of the Vulnerable Software and Affected Versions Netmaker versions prior to 1.5.0 Description Netmaker, which utilizes WireGuard, has an issue where the Authorize middleware does not properly validate host JWT tokens. When host authentication is permitted hostAllowed=true, a valid host token...

PT-2026-23870

Name of the Vulnerable Software and Affected Versions Netmaker versions prior to 1.5.0 Description Netmaker, which utilizes WireGuard, has an issue where the user update handler does not properly validate role assignments. Specifically, an administrator-role user can assign the super-admin role t...

CVE-2025-32430

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-3 through 16.4.7, 16.5.0-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, two templates contain reflected XSS vulnerabilities, allowing an attacker to execute...

CVE-2025-38430 affecting package kernel for versions less than 6.6.96.1-1

CVE-2025-38430 affecting package kernel for versions less than 6.6.96.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-49180 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-2

CVE-2025-49180 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-2. A patched version of the package is available...

CVE-2025-5455 affecting package qt5-qtbase for versions less than 5.12.11-18

CVE-2025-5455 affecting package qt5-qtbase for versions less than 5.12.11-18. A patched version of the package is available...

CVE-2025-49179 affecting package xorg-x11-server for versions less than 1.20.10-16

CVE-2025-49179 affecting package xorg-x11-server for versions less than 1.20.10-16. A patched version of the package is available...

Security update for grub2

This update for grub2 fixes the following issues: CVE-2024-56738: Fixed side-channel attack due to not constant-time algorithm in grubcryptomemcmp bsc1234959 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

CVE-2025-5061

The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpieparseuploaddata' function in all versions up to, and including, 3.9.29. This makes it possible for authenticated attackers, with Subscriber-level access and above...

s390/pkey: Prevent overflow in size calculation for memdup_user()

...

ACPICA: fix acpi parse and parseext cache leaks

...

CVE-2025-8548

A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function sendEmailCode of the file src/main/java/co/yiiu/pybbs/controller/api/SettingsApiController.java of the component Registered Email Handler. The manipulation of the argument email lea...

CVE-2025-54387

IPX is an image optimizer powered by sharp and svgo. In versions 1.3.1 and below, 2.0.0-0 through 2.1.0, and 3.0.0 through 3.1.0, the approach used to check whether a path is within allowed directories is vulnerable to path prefix bypass when the allowed directories do not end with a path...

CVE-2025-54784

SuiteCRM 7.14.0–7.14.6 contains a Cross Site Scripting (XSS) vulnerability in the email viewer. An attacker can trigger payloads by a logged-in user simply viewing emails, potentially allowing arbitrary actions, data extraction, or takeover if the user is an admin. A fix is available in version 7...