CVE-2024-57348

Cross Site Scripting vulnerability in PecanProject pecan through v.1.8.0 allows a remote attacker to execute arbitrary code via the crafted payload to the hostname, sitegroupid, lat, lon and sitename parameters...

CVE-2025-21845

In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: sst: Fix SST write failure 'commit 18bcb4aa54ea "mtd: spi-nor: sst: Factor out common write operation to sstnorwritedata"' introduced a bug where only one byte of data is written, regardless of the number of bytes...

CVE-2025-21848

In the Linux kernel, the following vulnerability has been resolved: nfp: bpf: Add check for nfpappctrlmsgalloc Add check for the return value of nfpappctrlmsgalloc in nfpbpfcmsgalloc to prevent null pointer dereference...

CVE-2025-22870 vulnerabilities

Vulnerabilities for packages: kubeflow, argo-cd-fips, external-secrets-fips, cloud-provider-aws-fips, tempo, pulumi-language-dotnet, xeol-fips, zot, crossplane-provider-aws-rds, fuse-overlayfs-snapshotter, nfs-subdir-external-provisioner, whereabouts, amazon-cloudwatch-agent-fips, guac, calico,...

Duplicate Advisory: Plenti - Code Injection - Denial of Services

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mj4v-hp69-27x5. This link is maintained to preserve external references. Original Description Plenti = 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can...

GHSA-WPXF-3MM2-76F8 vulnerabilities

Vulnerabilities for packages: gitlab-runner, gitlab-runner-fips...

CVE-2025-26916

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Pixflow Massive Dynamic massive-dynamic.This issue affects Massive Dynamic: from n/a through = 8.2...

RHSA-2025:2627 Red Hat Security Advisory: kernel security update

Bulletin has no description...

CVE-2025-21864 tcp: drop secpath at the same time as we currently drop dst

In the Linux kernel, the following vulnerability has been resolved: tcp: drop secpath at the same time as we currently drop dst Xiumei reported hitting the WARN in xfrm6tunnelnetexit while running tests that boil down to: - create a pair of netns - run a basic TCP test over ipcomp6 - delete the...

CVE-2025-21863 io_uring: prevent opcode speculation

In the Linux kernel, the following vulnerability has been resolved: iouring: prevent opcode speculation sqe-opcode is used for different tables, make sure we santitise it against speculations...

MAL-2025-2300 Malicious code in client-analytisc-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1413ae1456fe5f357befbd198d3c85b98e8d40e31b0d76c343d1cb6a9dfc9d95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2319 Malicious code in ledger-node-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7407ff449f6702424fde06ca2cab289054c649439e98f9b863029a985e8cfcf7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2252 Malicious code in dir-size-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f803eeed1967e8ae2cd3095d6f293153fe8b5574bbef8aa2191c4b2f862658f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2285 Malicious code in veryimportantdigiasdf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4216b87b158de7023dfdcc03968bb866298708f6f98f34877f88eb9e74b20eb8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

RHSA-2025:2524 Red Hat Security Advisory: kernel-rt security update

Bulletin has no description...

RHSA-2025:2517 Red Hat Security Advisory: kernel security update

Bulletin has no description...

CVE-2025-1920

Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

GO-2025-3500 In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim in github.com/matrix-org/pinecone

In-memory stored Cross-site scripting XSS vulnerability in pineconesim in github.com/matrix-org/pinecone...

CGA-X223-M8F5-C9VM

Bulletin has no description...

GO-2025-3505 Fleet has SAML authentication vulnerability due to improper SAML response validation in github.com/fleetdm/fleet

Fleet has SAML authentication vulnerability due to improper SAML response validation in github.com/fleetdm/fleet. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...