Huawei EulerOS: Security Advisory for abseil-cpp (EulerOS-SA-2025-1683)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-30211

Name of the Vulnerable Software and Affected Versions Mbed TLS versions 3.6.1 through 3.6.3 Description A timing discrepancy in block cipher padding removal allows an attacker to recover the plaintext when PKCS7 padding mode is used. Recommendations Update to version 3.6.4 or later...

PT-2025-27464 · Electron · Electron

Name of the Vulnerable Software and Affected Versions: Electron versions prior to 28.3.2 Electron versions prior to 29.3.3 Electron versions prior to 30.0.3 Description: The issue is related to heap buffer overflows in Electron's API, specifically affecting the nativeImage.createFromPath and...

PT-2025-30797

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.16.0-rc3+ 23 Description The Linux kernel contains a flaw in the NVME over TCP implementation related to suspicious RCU Read-Copy-Update usage within the nvme mpath add sysfs link function. This issue manifests...

Important Photon OS Security Update - PHSA-2025-5.0-0544

Updates of 'sudo' packages of Photon OS have been released...

PT-2025-27400 · Samsung +1 · Rlottie +1

Name of the Vulnerable Software and Affected Versions: rLottie version V0.2 Description: The issue is related to an Improper Input Validation vulnerability in Samsung Open Source rLottie, which allows Overread Buffers. Recommendations: For rLottie version V0.2, update to a version that includes a...

PT-2025-28013

Name of the Vulnerable Software and Affected Versions: MbedTLS versions 3.3.0 through 3.6.3 Description: The issue arises from the function mbedtls lms import public key not checking if the input buffer is at least 4 bytes before reading a 32-bit field. This allows for a possible out-of-bounds re...

JVN#24333956: SLNX Help Documentation of RICOH Streamline NX vulnerable to reflected cross-site scripting

SLNX Help Documentation of RICOH Streamline NX provided by Ricoh Company, Ltd. contains the following vulnerability. Reflected cross-site scripting via a specific parameter CWE-79 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N Base Score 5.1...

PT-2025-27370 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS versions up to 13.2 Description: A problematic issue has been found in SeaCMS, affecting some unknown functionality of the file /admin type.php. This issue leads to cross-site request forgery and can be exploited remotely...

CGA-5RGH-38CV-H5PQ

Bulletin has no description...

CVE-2025-53097 Roo Code extension vulnerable to Potential Information Leakage via JSON Schema

Roo Code is an AI-powered autonomous coding agent. Prior to version 3.20.3, there was an issue where the Roo Code agent's searchfiles tool did not respect the setting to disable reads outside of the VS Code workspace. This means that an attacker who was able to inject a prompt into the agent coul...

CVE-2025-5832

Pioneer DMH-WT7600NEX Software Update Signing Insufficient Verification of Data Authenticity Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Pioneer DMH-WT7600NEX devices. Authentication is not required to exploit this...

RHSA-2025:9845 Red Hat Security Advisory: weldr-client security update

Bulletin has no description...

RHSA-2025:9844 Red Hat Security Advisory: osbuild-composer security update

Bulletin has no description...

RHSA-2025:9756 Red Hat Security Advisory: opentelemetry-collector security update

Bulletin has no description...

MGASA-2025-0198 Updated gdk-pixbuf2.0 packages fix security vulnerability

It was discovered that incorrect bounds validation in the GIF decoder of the GDK Pixbuf library may result in memory disclosure...

PT-2025-27140 · Unknown · Directiq Email Marketing

Name of the Vulnerable Software and Affected Versions: DirectIQ Email Marketing versions n/a through 2.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-27212 · WordPress · Sh1Zen Wp Optimizer

Name of the Vulnerable Software and Affected Versions: sh1zen WP Optimizer versions 2.3.6 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows SQL Injection. Recommendations: For sh1zen WP Optimizer versions 2.3.6 and earlier, update to a version later...

PT-2025-27125 · Unknown · Xili-Dictionary

Name of the Vulnerable Software and Affected Versions: xili-dictionary versions through 2.12.5.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS in the xili-dictionary...

PT-2025-27132 · Unknown · Ovatheme Brw

Name of the Vulnerable Software and Affected Versions: ovatheme BRW versions 1.7.9 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local File...