RHSA-2025:9188 Red Hat Security Advisory: idm:DL1 security update

Bulletin has no description...

CVE-2025-38008 mm/page_alloc: fix race condition in unaccepted memory handling

In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: fix race condition in unaccepted memory handling The page allocator tracks the number of zones that have unaccepted memory using staticbranchenc/dec and uses that static branch in hot paths to determine if it needs ...

BELL-CVE-2025-49177

Bulletin has no description...

BELL-CVE-2025-49180

Bulletin has no description...

CVE-2025-50202 Lychee Path Traversal Vulnerability

Lychee is a free photo-management tool. In versions starting from 6.6.6 to before 6.6.10, an attacker can leak local files including environment variables, nginx logs, other user's uploaded images, and configuration secrets due to a path traversal exploit in SecurePathController.php. This issue h...

PT-2025-26185 · Peak System · Peak-System Driver

Name of the Vulnerable Software and Affected Versions: PEAK-System Driver affected versions not specified Description: This issue allows local attackers to disclose sensitive information on affected installations. An attacker must first obtain the ability to execute low-privileged code on the...

PT-2025-26178 · Ibm · Webmethods Integration Server

Name of the Vulnerable Software and Affected Versions: IBM webMethods Integration Server versions 10.5 through 10.15 Description: The issue allows a privileged user to escalate their privileges when handling external entities due to execution with unnecessary privileges. Recommendations: For...

CVE-2025-44952

A missing length check in ogspfcpsubnetadd function from PFCP library, used by both smf and upf in open5gs 2.7.2 and earlier, allows a local attacker to cause a Buffer Overflow by changing the session.dnn field with a value with length greater than 101...

PT-2025-26206 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.2 Description: The issue is related to an OS Command Injection flaw in the "/html/configuracao/debug info.php" endpoint. The branch parameter is not properly sanitized before being concatenated and executed in a...

CVE-2025-49149 Dify has XSS vulnerability

Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. Attackers can use website vulnerabilities to inject malicious script code into web pages. This may result in a cross-site scripting XSS attack when a user...

CVE-2025-30678

A Server-side Request Forgery SSRF vulnerability in Trend Micro Apex Central on-premise modTMSM component could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations...

CVE-2025-49877

CVE-2025-49877 : SSRF in the WordPress plugin ProfileGrid (Metagauss) affecting ProfileGrid versions up to and including 5.9.5.2. Root cause is a server-side request forgery vulnerability that could enable an attacker to induce the server to perform requests. Exploitation status is not detailed i...

CVE-2025-49179 Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x record extension

A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when computing request length, which allows a client to bypass length checks...

CVE-2025-6196 Libgepub: integer overflow in libgepub's epub archive handling

A flaw was found in libgepub, a library used to read EPUB files. The software mishandles file size calculations when opening specially crafted EPUB files, leading to incorrect memory allocations. This issue causes the application to crash. Known affected usage includes desktop services like...

WordPress Ivory Search plugin < 5.5.10 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by WPscan in WordPress Plugin Ivory Search versions 5.5.10...

RHSA-2025:9149 Red Hat Security Advisory: skopeo security update

Bulletin has no description...

MAL-2025-5332 Malicious code in @evg-ui/lib (npm)

Malicious package. Executes hidden script during install to exfiltrate local IP, hostname, and homedir to an OAST server. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee183b500af41035df15810e8e96ba76cf5a758c7d6d647678a1c3930ded627e Any computer that has this...

PT-2025-25719 · Unknown · Arconix Shortcodes

Name of the Vulnerable Software and Affected Versions: Arconix Shortcodes versions through 2.1.17 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-25701 · Unknown · Thembay Hara

Name of the Vulnerable Software and Affected Versions: thembay Hara versions 1.2.10 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability, which allows PHP Local File...

PT-2025-25709 · Unknown · Fw Gallery

Name of the Vulnerable Software and Affected Versions: FW Gallery versions n/a through 8.0.0 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in FW Gallery. Recommendations: For FW...