PT-2025-13195 · Upx +2 · Upx +2

Name of the Vulnerable Software and Affected Versions: UPX versions up to 5.0.0 Description: A problematic issue was found in the function PackLinuxElf64::un DT INIT of the file src/p lx elf.cpp, leading to a heap-based buffer overflow. The attack can be launched on the local host. Recommendation...

CVE-2025-2600

Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the ELEVATEDPASSWORD variable even though not allowed by the "Allow password in variable policy". This issue affects Remote Desktop Manager versions from 2025.1.24...

CVE-2025-0835

Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory...

wp-svg-upload WordPress plugin vulnerable to Stored Cross-site Scripting

The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks...

Denial Of Service (DoS)

ai.h2o, h2o-core is vulnerable to Denial Of Service DoS. The vulnerability is due to improper input validation of the path parameter in the /3/ImportFiles endpoint, allowing it to reference itself recursively and trigger an infinite loop...

PT-2025-13014 · Splunk · Splunk Cloud Platform +1

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.3.3 Splunk Enterprise versions prior to 9.2.5 Splunk Enterprise versions prior to 9.1.8 Splunk Cloud Platform versions prior to 9.3.2408.104 Splunk Cloud Platform versions prior to 9.2.2406.108 Splunk Clo...

DSA-5888-1 ghostscript - security update

Bulletin has no description...

CVE-2025-31160

atop through 2.11.0 allows local users to cause a denial of service e.g., assertion failure and application exit or possibly have unspecified other impact by running certain types of unprivileged processes while a different user runs atop...

Pixelfed may allow unauthorized actor to view private posts and private users

Pixelfed before 0.12.5 allows anyone to follow private accounts and see private posts on other Fediverse servers. This affects users elsewhere in the Fediverse, if they otherwise have any followers from a Pixelfed instance...

CVE-2025-27830

An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs during serialization of DollarBlend in a font, for base/writet1.c and psi/zfapi.c...

CVE-2025-25374

In NASA cFS Core Flight System Aquila, it is possible to put the onboard software in a state that will prevent the launch of any external application, causing a platform denial of service...

CVE-2025-27833

An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdffmap.c...

GO-2025-3545 CVE-2024-53348 in github.com/loxilb-io/loxilb

CVE-2024-53348 in github.com/loxilb-io/loxilb...

GO-2025-3538 kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp

kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp...

GO-2025-3550 Mattermost Fails to Restrict Command Execution in Archived Channels in github.com/mattermost/mattermost-server

Mattermost Fails to Restrict Command Execution in Archived Channels in github.com/mattermost/mattermost-server...

BIT-VARNISH-2025-30346

Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests...

MAL-2025-2654 Malicious code in cdn-icon-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c5df12b33f292879e5c1199fb8a0130cbbb1a1cd4cf1d3e72cb723143ccaa1d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2718 Malicious code in vue-official-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54297a016228c62dcc04040f8aaf8e680d35a868040c66105b3418e472d4fd67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2633 Malicious code in @sensort/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2dcd07bb07971882b98c1d3a975179dac6c620077f929f4d8d579c511f38b89c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-10679 Quiz and Survey Master (QSM) < 9.2.1 - Author+ Stored XSS

The Quiz and Survey Master QSM WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...