GHSA-GCQF-F89C-68HV Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information

Vault Community and Vault Enterprise Key/Value kv Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is...

CVE-2025-2605 Authenticated command injection

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Honeywell MB-Secure allows Privilege Abuse. This issue affects MB-Secure: from V11.04 before V12.53 and MB-Secure PRO from V01.06 before V03.09.Honeywell also recommends updating to the most...

MozillaThunderbird-128.10.0-1.1 on GA media (moderate)

MozillaThunderbird-128.10.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:15042-1 Rating: moderate Cross-References: CVE-2025-2817 CVE-2025-4082 CVE-2025-4083 CVE-2025-4084 CVE-2025-4087 CVE-2025-4091 CVE-2025-4093 CVSS scores: CVE-2025-2817 SUSE : 7.8...

PT-2025-18732 · Ibm · Ibm Concert

Name of the Vulnerable Software and Affected Versions: IBM Concert Software versions 1.0.0 through 1.0.5 Description: The issue is related to server-side request forgery SSRF, which may allow an authenticated attacker to send unauthorized requests from the system. This could potentially lead to...

PT-2025-18760 · United Planet · Intrexx Portal Server

Name of the Vulnerable Software and Affected Versions: Intrexx Portal Server versions prior to 12.0.4 Description: The issue allows for the execution of unrequested JavaScript code in HTML, also known as Cross-Site Scripting XSS. This occurs due to susceptible Velocity-Scripts in the affected...

PT-2025-18744 · WordPress · Flynax Bridge

Name of the Vulnerable Software and Affected Versions: Flynax Bridge plugin for WordPress versions up to, and including, 2.2.0 Description: The issue is related to a missing capability check on the deleteUser function, allowing unauthorized loss of data. This makes it possible for unauthenticated...

DLA-3695-2 ansible - regression update

Bulletin has no description...

CVE-2022-49838 sctp: clear out_curr if all frag chunks of current msg are pruned

In the Linux kernel, the following vulnerability has been resolved: sctp: clear outcurr if all frag chunks of current msg are pruned A crash was reported by Zhen Chen: listdel corruption, ffffa035ddf01c18-next is NULL WARNING: CPU: 1 PID: 250682 at lib/listdebug.c:49 listdelentryvalid+0x59/0xe0...

Apple AirPlay SDK devices at risk of takeover—make sure you update

Researchers found a set of vulnerabilities in Apple’s AirPlay SDK that put billions of users at risk of their devices being taking over. AirPlay is Apple's proprietary wireless technology that allows you to stream audio, video, photos, and even mirror your device's screen from an iPhone, iPad, or...

PT-2025-22185

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.15.0-rc1-syzkaller-00301-g3bde70a2c827 Description A bug has been reported in the Linux kernel where the trace seq to buffer function attempts to copy more data than PAGE SIZE to a buffer, resulting in an...

PT-2025-18692 · Kunbus · Kunbus Pictory

Name of the Vulnerable Software and Affected Versions: KUNBUS PiCtory versions 2.5.0 through 2.11.1 Description: The issue allows a remote attacker to bypass authentication and gain access due to a path traversal vulnerability. This enables unauthorized access, potentially leading to further...

PT-2025-18367 · WordPress · The Team Members – Best Wordpress Team Plugin

Name of the Vulnerable Software and Affected Versions: The Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder plugin for WordPress versions up to, and including, 3.4.0 Description: The issue is related to Stored Cross-Site Scripting via Social Link icons due ...

RHSA-2025:4362 Red Hat Security Advisory: ghostscript security update

Bulletin has no description...

DLA-4143-1 glibc - security update

Bulletin has no description...

PT-2025-18320 · Base-X · Base-X

Name of the Vulnerable Software and Affected Versions: base-x versions prior to 3.0.11 base-x version 4.0.0 base-x version 5.0.0 Description: The issue allows attackers to potentially deceive users into sending funds to an unintended address. This is achieved through a problem in the base-x encod...

PT-2025-18289 · Joplin · Joplin

Name of the Vulnerable Software and Affected Versions: Joplin versions prior to 3.3.3 Description: The issue allows path traversal in Joplin Server when the static file path starts with css/pluginAssets or js/pluginAssets. The findLocalFile function in the default route calls localFileFromUrl to...

CGA-3M43-38G5-6PP9

Bulletin has no description...

RHSA-2025:4244 Red Hat Security Advisory: glibc security update

Bulletin has no description...

Security Bulletin: NVIDIA TensorRT LLM - April 2025

NVIDIA has released a software update for NVIDIA® TensorRT LLM Framework. To protect your system, download and install the latest release from the https://github.com/NVIDIA/TensorRT/releases page on GitHub. Go to NVIDIA Product Security...

PT-2025-18143

Name of the Vulnerable Software and Affected Versions MDaemon Email Server versions 25.0.1 and below Description A Stored Cross-Site Scripting XSS issue was discovered, allowing a remote attacker to send a specially crafted HTML e-mail message with JavaScript in an img tag. This could enable the...