Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to improper access control due to the linux-pam package (CVE-2025-6020)

Summary Linux-pam is used by DataStage on Cloud Pak for Data as part of the authentication functionality. Vulnerability Details CVEID:CVE-2025-6020 DESCRIPTION: A flaw was found in linux-pam. The module pamnamespace may use access user-controlled paths without proper protection, allowing local...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to allocation of resource abuse due to the commons-fileupload package (CVE-2025-48976)

Summary Commons-fileupload is used by DataStage on Cloud Pak for Data as part of the file handling functionality. Vulnerability Details CVEID:CVE-2025-48976 DESCRIPTION: Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload...

Linux Distros Unpatched Vulnerability : CVE-2019-10145

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rkt through version 1.30.0 does not isolate processes in containers that are run with rkt enter. Processes run with rkt enter do not have seccomp filtering duri...

Linux Distros Unpatched Vulnerability : CVE-2019-10147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rkt through version 1.30.0 does not isolate processes in containers that are run with rkt enter. Processes run with rkt enter are not limited by cgroups during...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to prototype pollution due to the minimist package (CVE-2021-44906)

Summary Minimist is used by DataStage on Cloud Pak for Data as part of the command-line parsing functionality. Vulnerability Details CVEID:CVE-2021-44906 DESCRIPTION: Minimist =1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey lines 69-95. CWE:CWE-1321: Improperly...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to plaintext token modification due to the krb5 package (CVE-2024-37370)

Summary krb5 is used by DataStage on Cloud Pak for Data as part of network authentication. Vulnerability Details CVEID:CVE-2024-37370 DESCRIPTION: In MIT Kerberos 5 aka krb5 before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to out of bounds memory access due to the libarchive package (CVE-2024-37407)

Summary Libarchive is used by DataStage on Cloud Pak for Data as part of archive/compression functionality. Vulnerability Details CVEID:CVE-2024-37407 DESCRIPTION: Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled. This occur...

CVE-2025-53328

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Opinion Stage Poll, Survey & Quiz Maker Plugin by Opinion Stage social-polls-by-opinionstage allows PHP Local File Inclusion.This issue affects Poll, Survey & Quiz Maker Plugin b...

Linux Distros Unpatched Vulnerability : CVE-2024-5660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use of Hardware Page Aggregation HPA and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1,...

CVE-2025-53328

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Opinion Stage Poll, Survey & Quiz Maker Plugin by Opinion Stage social-polls-by-opinionstage allows PHP Local File Inclusion.This issue affects Poll, Survey & Quiz Maker Plugin b...

CVE-2025-53328 WordPress Poll, Survey & Quiz Maker Plugin by Opinion Stage Plugin <= 19.11.0 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Opinion Stage Poll, Survey & Quiz Maker Plugin by Opinion Stage social-polls-by-opinionstage allows PHP Local File Inclusion.This issue affects Poll, Survey & Quiz Maker Plugin b...

CVE-2025-53328 WordPress Poll, Survey & Quiz Maker Plugin by Opinion Stage Plugin <= 19.11.0 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Assaf Parag Poll, Survey & Quiz Maker Plugin by Opinion Stage allows PHP Local File Inclusion. This issue affects Poll, Survey & Quiz Maker Plugin by Opinion Stage: from n/a...

CVE-2025-53328

CVE-2025-53328 is a Local File Inclusion vulnerability in the WordPress plugin Poll, Survey & Quiz Maker Plugin by Opinion Stage (versions up to 19.11.0). Root cause: improper control of filename for include/require in PHP, enabling LFI. Affected: Poll, Survey & Quiz Maker Plugin by Opinion Stage (

WordPress plugin Poll, Survey & Quiz Maker Plugin by Opinion Stage 安全漏洞

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A security vulnerability exists in WordPress plugin Poll, Survey & Quiz Maker Plugin...

PT-2025-35057

Name of the Vulnerable Software and Affected Versions: Assaf Parag Poll, Survey & Quiz Maker Plugin by Opinion Stage versions through 19.11.0 Description: The software contains an Improper Control of Filename for Include/Require Statement, also known as a PHP Remote File Inclusion issue. This...

ShadowCaptcha Exploits WordPress Sites to Spread Ransomware, Info Stealers, and Crypto Miners

A new large-scale campaign has been observed exploiting over 100 compromised WordPress sites to direct site visitors to fake CAPTCHA verification pages that employ the ClickFix social engineering tactic to deliver information stealers, ransomware, and cryptocurrency miners. The large-scale...

WordPress Poll, Survey & Quiz Maker Plugin by Opinion Stage Plugin <= 19.11.0 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Poll, Survey & Quiz Maker Plugin by Opinion Stage versions = 19.11.0...

CVE-2025-38647

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: sar: drop lockdep assertion in rtw89setsarfromacpi The following assertion is triggered on the rtw89 driver startup. It looks meaningless to hold wiphy lock on the early init stage so drop the assertion. WARNING: CPU...

Cybercriminals Deploy CORNFLAKE.V3 Backdoor via ClickFix Tactic and Fake CAPTCHA Pages

Threat actors have been observed leveraging the deceptive social engineering tactic known as ClickFix to deploy a versatile backdoor codenamed CORNFLAKE.V3. Google-owned Mandiant described the activity, which it tracks as UNC5518, as part of an access-as-a-service scheme that employs fake CAPTCHA...

CVE-2025-38551

A flaw was found in the Linux kernel’s virtio-net driver, where a recursive rtnllock could be triggered during device probing. The deadlock occurs when a VIRTIONETSANNOUNCE request is received from the VMM while the driver is still in the probe stage. In this scenario, the configwork scheduled by...