ALSA-2025:10676 Moderate: golang security update

The golang packages provide the Go programming language compiler. Security Fixes: net/http: Sensitive headers not cleared on cross-origin redirect in net/http CVE-2025-4673 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...

PT-2025-28902 · Jenkins · Jenkins Credentials Binding Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Credentials Binding Plugin versions 687.v619cb 15e923f and earlier Description: The Jenkins Credentials Binding Plugin does not properly mask credentials present in exception error messages written to the build log. This can lead to t...

PT-2025-30493

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 138.0.7204.168 Description: A type confusion issue exists in the V8 JavaScript engine used in Google Chrome. This could allow a remote attacker to potentially exploit heap corruption through a specially crafted...

PT-2025-28966 · WordPress · Events Manager

Name of the Vulnerable Software and Affected Versions: Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress versions prior to 7.0.4 Description: The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is susceptible to Reflected Cross-Site Scriptin...

PT-2025-28955 · Drupal · Mail Login

Name of the Vulnerable Software and Affected Versions: Drupal Mail Login versions 3.0.0 through 3.1.x Drupal Mail Login versions 4.0.0 through 4.1.x Description: An improper restriction of excessive authentication attempts exists in Drupal Mail Login, allowing for brute force attacks...

PT-2025-28929 · Jenkins · Jenkins Xooa Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Xooa Plugin versions 0.0.7 and earlier Description: The Jenkins Xooa Plugin does not mask the Xooa Deployment Token on the global configuration form, potentially allowing attackers to observe and capture it. Recommendations: Update to...

PT-2025-30492

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 138.0.7204.168 Microsoft Edge versions prior to 138.0.7204.168 Chromium versions prior to 138.0.7204.168 Chromium versions 138.0.7204.168-1deb12u1 Description A type confusion issue exists in the V8 JavaScript...

PT-2025-28941

Name of the Vulnerable Software and Affected Versions: Ameba-AIoT ameba-arduino-d versions prior to 3.1.9 ameba-rtos-d versions prior to commit c2bfd8216a1cbc19ad2ab5f48f372ecea756d67a Description: A heap-based buffer overflow exists in the WLAN driver defragment function due to a lack of...

CVE-2025-48384 Git allows arbitrary code execution through broken config quoting

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed CRLF. When writing a config entry, values with ...

RHSA-2025:10410 Red Hat Security Advisory: tigervnc security update

Bulletin has no description...

RHSA-2025:10407 Red Hat Security Advisory: python-setuptools security update

Bulletin has no description...

RHBA-2025:6470 Red Hat Bug Fix Advisory: rsync bug fix and enhancement update

Bulletin has no description...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in jsonpath-plus-0.19.0.tgz

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of jsonpath-plus-0.19.0.tgz Vulnerability Details CVEID:CVE-2024-21534 DESCRIPTION: All versions of the package jsonpath-plus are vulnerable to Remote Code Execution RCE due to improper input sanitization. An attacker can...

PT-2025-28771 · Adobe · Framemaker

Name of the Vulnerable Software and Affected Versions: Adobe Framemaker versions 2020.8 through 2022.6 Description: Adobe Framemaker is susceptible to a NULL Pointer Dereference issue that may result in application denial-of-service. Exploitation of this issue requires a user to open a malicious...

PT-2025-28408 · Unknown · Quiter Gateway

Name of the Vulnerable Software and Affected Versions: Quiter Gateway versions prior to 4.7.0 Description: The issue allows an attacker to retrieve, create, update, and delete databases through the campo parameter in the "/FacturaE/BusquedasFacturasSesion" endpoint. Recommendations: For versions...

PT-2025-28416 · Unknown · Quiter Gateway

Name of the Vulnerable Software and Affected Versions: Quiter Gateway versions prior to 4.7.0 Description: A Reflected Cross-site Scripting XSS issue allows an attacker to execute JavaScript code in a victim's browser. This is achieved by sending a malicious URL through the id factura parameter i...

PT-2025-28777 · Adobe · Framemaker

Name of the Vulnerable Software and Affected Versions: Adobe Framemaker versions 2020.8, 2022.6 and earlier Description: The issue is a Heap-based Buffer Overflow that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction...

PT-2025-28751 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier Description: The issue is related to an Improper Restriction of XML External Entity Reference 'XXE' vulnerability. This could result in a security feature bypass, allowing a...

PT-2025-28761 · Adobe · Indesign Desktop

Name of the Vulnerable Software and Affected Versions: InDesign Desktop versions 19.5.3 and earlier Description: InDesign Desktop versions 19.5.3 and earlier are susceptible to an out-of-bounds write issue. Successful exploitation of this issue could lead to arbitrary code execution with the...

PT-2025-28486

Name of the Vulnerable Software and Affected Versions: Ivanti Endpoint Manager Mobile EPMM versions prior to 12.5.0.2 Ivanti Endpoint Manager Mobile EPMM version 12.4.0.3 Ivanti Endpoint Manager Mobile EPMM version 12.3.0.3 Description: The issue allows a remote authenticated attacker with high...