PT-2025-18192 · Docker · Docker Desktop

Name of the Vulnerable Software and Affected Versions: Docker Desktop versions prior to 4.41.0 Description: The issue concerns the recording of environment variables in Docker Desktop application logs, which could lead to unintentional disclosure of sensitive information such as API keys and...

PT-2025-18212

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.5.4 Description The issue affects the /BazaR endpoint and the idformulaire parameter, making them vulnerable to cross-site scripting. An attacker can use a reflected cross-site scripting attack to steal cookies from...

DLA-4142-1 libraw - security update

Bulletin has no description...

PT-2025-18217

Name of the Vulnerable Software and Affected Versions vLLM versions 0.8.0 through 0.8.4 Description The issue concerns a critical performance vulnerability in the input preprocessing logic of the multimodal tokenizer. It is caused by inefficient list concatenation operations, resulting in quadrat...

PT-2025-18160

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 138 Firefox ESR versions prior to 128.10 Thunderbird versions prior to 138 Thunderbird ESR versions prior to 128.10 Description Memory safety bugs are present, showing evidence of memory corruption. It is presumed tha...

Slackware Linux 15.0 / current mozilla-thunderbird Multiple Vulnerabilities (SSA:2025-119-02)

The version of mozilla-thunderbird installed on the remote host is prior to 128.10.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-119-02 advisory. New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix security issues...

PT-2025-18161

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 138 Thunderbird versions prior to 138 Description Memory safety bugs are present in certain versions of Firefox and Thunderbird, showing evidence of memory corruption. It is presumed that with enough effort, some of...

PT-2025-18152

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 138 Firefox ESR versions prior to 128.10 Firefox ESR versions prior to 115.23 Thunderbird versions prior to 138 Thunderbird ESR versions prior to 128.10 Description A process isolation issue stems from improper handli...

Security Bulletin: NVIDIA TensorRT LLM - April 2025

NVIDIA has released a software update for NVIDIA® TensorRT LLM Framework. To protect your system, download and install the latest release from the https://github.com/NVIDIA/TensorRT/releases page on GitHub. Go to NVIDIA Product Security...

PT-2025-18143

Name of the Vulnerable Software and Affected Versions MDaemon Email Server versions 25.0.1 and below Description A Stored Cross-Site Scripting XSS issue was discovered, allowing a remote attacker to send a specially crafted HTML e-mail message with JavaScript in an img tag. This could enable the...

Apache Tomcat Rewrite rule bypass

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those...

RHSA-2025:4228 Red Hat Security Advisory: mod_auth_openidc:2.3 security update

Bulletin has no description...

LibreOffice Improper Verification of Cryptographic Signature Vulnerability (Apr 2025) - Linux

LibreOffice is prone to an improper verification of cryptographic signature vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE ...

PT-2025-18093 · Dify · Dify

Name of the Vulnerable Software and Affected Versions: DIFY versions prior to 1.3.0 Description: A clickjacking issue was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This...

PT-2025-18045 · Mantus667 · Wp-Pmanager

Name of the Vulnerable Software and Affected Versions: WP-PManager WordPress plugin version 1.2 and earlier SAP NetWeaver affected versions not specified Description: The issue allows for SQL injection attacks due to a parameter not being sanitized and escaped before use in a SQL statement. A...

PT-2025-18117 · Unknown · Goanywhere

Name of the Vulnerable Software and Affected Versions: GoAnywhere versions prior to 7.8.0 Description: The issue occurs when a web user without create permission on subfolders attempts to upload a file to a non-existent directory. In this scenario, the error message includes the absolute server...

PT-2025-18091 · Onevision · Onevision Workspace

Name of the Vulnerable Software and Affected Versions: OneVision Workspace versions prior to WS23.1 SR1 build w31.040 Description: The issue allows for arbitrary Java EL execution. This means that an attacker could potentially execute malicious Java Expression Language code, leading to unauthoriz...

PT-2025-18010 · Document Foundation +4 · Libreoffice +4

Name of the Vulnerable Software and Affected Versions: LibreOffice versions 24.8 through 24.8.5 LibreOffice versions 25.2 through 25.2.1 Description: The issue is related to an Improper Verification of Cryptographic Signature, allowing PDF Signature Spoofing by Improper Validation. A flaw in the...

DLA-4140-1 libsoup2.4 - security update

Bulletin has no description...

PT-2025-18013 · Unknown +1 · Quickjs-Ng +1

Name of the Vulnerable Software and Affected Versions: quickjs-ng versions 0.9.0 and earlier QuickJS versions prior to 2025-04-26 Description: The issue is related to a missing length check in JS ReadString for a string, which can lead to a heap-based buffer overflow. Recommendations: For...