CVE-2025-13837

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues...

Denial Of Service (DoS)

github.com/siderolabs/omni is vulnerable to Denial of service DoS. The vulnerability is due to improper validation of the resource metadata field in the isSensitiveSpec function, followed by an unchecked call to CreateResource, which allows an attacker to send empty create/update requests...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The package was flagged as malicious during the Sha1-hulud supply chain attack. Although the Sha1-hulud IoCs are not present within the package, the contents of the affected version were removed from the officia...

Malicious code in @kong/spec-renderer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb95018d12b664fc03fb69a58512ad0f479a61403b520ae8b325153404f3e14b The package @kong/spec-renderer was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191455 Malicious code in @kong/spec-renderer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb95018d12b664fc03fb69a58512ad0f479a61403b520ae8b325153404f3e14b The package @kong/spec-renderer was found to contain malicious code. Source: ghsa-malware...

SUSE-SU-2025:3681-1 Security update for go1.25

This update for go1.25 fixes the following issues: go1.25.3 released 2025-10-13 includes fixes to the crypto/x509 package. bsc1244485 CVE-2025-58187 go75861 crypto/x509: TLS validation fails for FQDNs with trailing dot go75777 spec: Go1.25 spec should be dated closer to actual release date Furthe...

CVE-2025-12861

A vulnerability was determined in DedeBIZ up to 6.3.2. Affected by this vulnerability is an unknown functionality of the file /admin/specadd.php. This manipulation of the argument flags causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclose...

EUVD-2025-38271

A vulnerability was determined in DedeBIZ up to 6.3.2. Affected by this vulnerability is an unknown functionality of the file /admin/specadd.php. This manipulation of the argument flags causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclose...

CVE-2025-12861

A vulnerability was determined in DedeBIZ up to 6.3.2. Affected by this vulnerability is an unknown functionality of the file /admin/specadd.php. This manipulation of the argument flags causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclose...

CVE-2025-12861

A vulnerability was determined in DedeBIZ up to 6.3.2. Affected by this vulnerability is an unknown functionality of the file /admin/specadd.php. This manipulation of the argument flags causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclose...

CVE-2025-12861 DedeBIZ spec_add.php sql injection

A vulnerability was determined in DedeBIZ up to 6.3.2. Affected by this vulnerability is an unknown functionality of the file /admin/specadd.php. This manipulation of the argument flags causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclose...

CVE-2025-12861 DedeBIZ spec_add.php sql injection

A vulnerability was determined in DedeBIZ up to 6.3.2. Affected by this vulnerability is an unknown functionality of the file /admin/specadd.php. This manipulation of the argument flags causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclose...

CVE-2025-12861

A vulnerability was determined in DedeBIZ up to 6.3.2. Affected by this vulnerability is an unknown functionality of the file /admin/specadd.php. This manipulation of the argument flags causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclose...

CVE-2025-12861

CVE-2025-12861 affects DedeBIZ up to version 6.3.2. The vulnerability resides in /admin/spec_add.php, where manipulation of the flags[] parameter enables SQL injection. Exploitation is remote and public. Remediation: update to a fixed version (6.3.2+ or later) or apply vendor-provided mitigations.

PT-2025-45465

Name of the Vulnerable Software and Affected Versions DedeBIZ versions up to 6.3.2 Description A flaw exists in DedeBIZ that allows for remote SQL injection. This issue is related to the manipulation of the flags argument within the /admin/spec add.php file. The exploit for this issue has been...

Fedora 42 : openapi-python-client (2025-16b2da653e)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-16b2da653e advisory. - add patch to remove dependency upper bound versions - remove obsolete patches that updated upper bound versions - clean up spec file formatting Tenable has...

Fedora 43 : openapi-python-client (2025-ce3d358bcc)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-ce3d358bcc advisory. - add patch to remove dependency upper bound versions - remove obsolete patches that updated upper bound versions - clean up spec file formatting Tenable has...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fixed a NULL pointer dereferencing in corescsi3decodespeciport. The function corescsi3decodespeciport, during its error code path, corescsi3lunaclundependitem, passing the destsedeve pointer, which may be NULL. This...

Security update for go1.25

This update for go1.25 fixes the following issues: go1.25.3 released 2025-10-13 includes fixes to the crypto/x509 package. bsc1244485 go75861 crypto/x509: TLS validation fails for FQDNs with trailing dot go75777 spec: Go1.25 spec should be dated closer to actual release date Further fixups to the...

nuxt-spec (>=0.1.10, <=0.1.11) potentially affected by CVE-2025-62410 via happy-dom (20.0.0)

happy-dom NPM version 20.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on happy-dom and may be impacted: - nuxt-spec =0.1.10, =0.1.11 Source cves: CVE-2025-62410 Source advisory: SNYK:JS-HAPPYDOM-13559227...