Linux Distros Unpatched Vulnerability : CVE-2025-14762

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to differe...

The vulnerability of the QEMU hardware emulation software, related to the use of memory after it is freed, allows a hacker to trigger a service failure.

The vulnerability of the QEMU hardware emulation software is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

SUSE: Security Advisory (SUSE-SU-2025:4416-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-65562

The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests. An unauthenticated remote attacker can send a request with a very large SEID e.g., 0xFFFFFFFFFFFFFFFF that causes an integer conversion/underflow in LocalNode.DeleteSess /...

Fedora: Security Advisory (FEDORA-2025-bf07d21f3e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-53933

Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attackers can upload files with system command payloads to the media upload endpoint and execute arbitrary commands on the server...

CVE-2025-68147 opensourcepos has a Cross-site Scripting vulnerability

Open Source Point of Sale opensourcepos is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Stored Cross-Site Scripting XSS vulnerability exists in the "Return Policy" configuration field. The application doe...

CVE-2025-68147 opensourcepos has a Cross-site Scripting vulnerability

Open Source Point of Sale opensourcepos is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Stored Cross-Site Scripting XSS vulnerability exists in the "Return Policy" configuration field. The application doe...

CVE-2025-46278

The issue was addressed with improved handling of caches. This issue is fixed in macOS Tahoe 26.2. An app may be able to access protected user data...

CVE-2025-14762

Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate this issue,...

CVE-2025-14761

Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate this issue, upgra...

EUVD-2025-203984

Auth0 Laravel SDK has Improper Audience Validation via Auth0-PHP SDK dependency...

CVE-2025-43536

CVE-2025-43536 is a use-after-free in WebKitGTK/WebKit2GTK triggered by processing malicious web content, leading to an unexpected process crash. Affected package: webkitgtk4 (WebKitGTK). Fixes are provided in WebKitGTK/WebKit2GTK updates: Debian 11 bullseye and Debian 12 bookworm patches (2.50.4...

Use of a Broken or Risky Cryptographic Algorithm

Overview Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm due to missing cryptographic key commitment when storing encrypted data keys in an instruction file. An attacker with write access to the S3 bucket can manipulate encrypted data keys to...

CVE-2025-14760

CVE-2025-14760 affects the AWS SDK for C++ and is reported in multiple sources including Red Hat and VMware Photon advisories. The issue is described as missing cryptographic key commitment that could allow a user with write access to an S3 bucket to insert a new envelope data key (EDK) that decr...

CVE-2025-34439

Summary: CVE-2025-34439 affects AVideo versions prior to 20.1, with an open redirect flaw during user login due to missing validation of the cancelUri parameter. What’s affected: AVideo before version 20.1. Root cause: Lack of input validation on cancelUri during login, enabling an attacker to cr...

CVE-2025-34441

CVE-2025-34441 affects AVideo versions prior to 20.1, exposing emails, usernames, admin status, and last login times via an unauthenticated public API endpoint, enabling user enumeration/privacy violations. Connected sources also describe unauthenticated RCE paths in AVideo 14.3.1+ through notify...

CVE-2025-53398

The Portrait Dell Color Management application 3.3.8 for Dell monitors has Insecure Permissions,...

EUVD-2025-203895

A vulnerability in the application software of multiple Radiometer products may allow remote code execution and unauthorized device management when specific internal conditions are met. Exploitation requires that a remote connection is established with additional information obtained through othe...

K000158176: NGINX Ingress Controller vulnerability CVE-2025-14727

Security Advisory Description A vulnerability exists in the NGINX Ingress Controller nginx . org/rewrite-target annotation validation. CVE-2025-14727 Note : Support for path rewrites using the nginx . org/rewrite-target annotation was added in NGINX Ingress Controller version 5.3.0. For more...