CVE-2025-30221 Pitchfork HTTP Request/Response Splitting vulnerability

Pitchfork is a preforking HTTP server for Rack applications. Versions prior to 0.11.0 are vulnerable to HTTP Response Header Injection when used in conjunction with Rack 3. The issue was fixed in Pitchfork release 0.11.0. No known workarounds are available...

MAL-2025-2732 Malicious code in @johndeere-tech/helios-mat-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 226a36baff3a45f171643849384a2b5ba6f9120f2a98d58b2589fc9381fc1c8a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-2867 Improper Control of Generation of Code ('Code Injection') in GitLab

An issue has been discovered in the GitLab Duo with Amazon Q affecting all versions from 17.8 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A specifically crafted issue could manipulate AI-assisted development features to potentially expose sensitive project data to unauthorized...

CVE-2025-2255 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in Gitlab EE/CE for AppSec affecting all versions from 13.5.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Certain error messages could allow Cross-Site Scripting attacks XSS. for AppSec...

RUSTSEC-2025-0032 Safe API can cause heap-buffer-overflow

ffi::nstr should be marked unsafe, since a pointer to a buffer without a trailing 0 value will cause a heap buffer overflow...

CVE-2024-55073

A Broken Object Level Authorization vulnerability in the component /api/users/user-id of hay-kot mealie v2.2.0 allows users to edit their own profile in order to give themselves more permissions or to change their household...

OPENSUSE-SU-2025:14933-1 corosync-3.1.9-2.1 on GA media

These are all security issues fixed in the corosync-3.1.9-2.1 package on the GA media of openSUSE Tumbleweed...

CVE-2025-29486

libming v0.4.8 was discovered to contain a memory leak via the parseSWFPLACEOBJECT3 function...

CVE-2025-30232

A use-after-free in Exim 4.96 through 4.98.1 could allow users with command-line access to escalate privileges...

CVE-2025-30093

HTCondor 23.0.x before 23.0.22, 23.10.x before 23.10.22, 24.0.x before 24.0.6, and 24.6.x before 24.6.1 allows authenticated attackers to bypass authorization restrictions...

MAL-2025-2729 Malicious code in nylas-apex-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 86275583c18eae2d336cf927f8e7a3a259fa70c98e0316305e579a4e6d11352e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

RHSA-2025:3208 Red Hat Security Advisory: kernel security update

Bulletin has no description...

RHSA-2025:3185 Red Hat Security Advisory: gvisor-tap-vsock security update

Bulletin has no description...

RHSA-2025:3165 Red Hat Security Advisory: podman security update

Bulletin has no description...

CVE-2024-55965

An issue was discovered in Appsmith before 1.51. Users invited as "App Viewer" incorrectly have access to development information of a workspace specifically, a list of datasources in a workspace they're a member of. This information disclosure does not expose sensitive data in the datasources,...

DLA-4092-1 libcap2 - security update

Bulletin has no description...

ALSA-2025:3262 Moderate: nginx:1.24 security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: specially crafted MP4 file may cause denial of service CVE-2024-7347 For more details about the security issues, including the impact, a...

ALSA-2025:3261 Moderate: nginx:1.22 security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: specially crafted MP4 file may cause denial of service CVE-2024-7347 For more details about the security issues, including the impact, a...

MAL-2025-3462 Malicious code in quicolor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4b11a81f135d7d2ac414b7144af73523d15db7b0ce1a2757ba6ba95f50bf0be8 Importing the module starts a code that exfiltrates data from local Telegram application --- Category: MALICIOUS - The campaign has clearly malicious intent,...

MAL-2025-2660 Malicious code in consolidate-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab51d3f2f1f669e9f16db54bd9c1699dcc1dfa4e1f6c8f9b6dfa0174b331f3e6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...