AlmaLinux 9 : sssd (ALSA-2025:20954)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:20954 advisory. sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems CVE-2025-11561 Tenable has extracted the preceding description...

CVE-2025-64460

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in django.core.serializers.xmlserializer.getInnerText allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML...

CVE-2025-41066

Horde Groupware v5.2.22 has a user enumeration vulnerability that allows an unauthenticated attacker to determine the existence of valid accounts on the system. To exploit the vulnerability, an HTTP request must be sent to ‘/imp/attachment.php’ including the parameters ‘id’ and ‘u’. If the...

CVE-2025-13372

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed to QuerySet.annotate or QuerySet.alias on PostgreSQL. Earlier...

CVE-2025-13467 vulnerabilities

Vulnerabilities for packages: keycloak, keycloak-fips...

Exploit for Out-of-bounds Write in Apple Ipados

CVE-2025-43300: iOS/macOS DNG Image Processing Memory Corrupti...

Like Social Media, AI Requires Difficult Choices

In his 2020 book, "Future Politics , " British barrister Jamie Susskind wrote that the dominant question of the 20th century was "How much of our collective life should be determined by the state, and what should be left to the market and civil society?" But in the early decades of this century,...

Industrial Video & Control Longwatch

RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthenticated attacker to gain remote code execution with elevated privileges. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such...

Mirion Medical EC2 Software NMIS BioDose

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to modify program executables, gain access to sensitive information, gain unauthorized access to the application, and execute arbitrary code. 2. RECOMMENDED PRACTICES CISA recommends users take defensive...

MAL-2025-191557 Malicious code in codemirror-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 788b98a42ba1658c92e6e86494ddd747ab154a01be456dfe9656760bd264fe46 The package codemirror-5 was found to contain malicious code. Source: ghsa-malware 0803dd9e41e867827659b46d2934d1a9700667e0f731dce60093ab5f9457c07f A...

PT-2025-48748

Name of the Vulnerable Software and Affected Versions JumpCloud Remote Assist for Windows versions prior to 0.317.0 Description JumpCloud Remote Assist for Windows includes an uninstaller that operates with high privileges during agent uninstall or update operations. The uninstaller performs file...

Axios Systems Assyst 安全漏洞

Axios Systems Assyst is an off-the-shelf application from Axios Systems, UK, for managing IT services without the complexity and overhead associated with ITSM platforms such as ServiceNow and BMC Remedy. Axios Systems Assyst has a security vulnerability that stems from a specially crafted dict ke...

CVE-2025-66030 vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-centraldashboard, kubeflow-katib, jitsucom-jitsu, kubeflow-pipelines, opensearch-dashboards...

CVE-2025-65408

A NULL pointer dereference in the ADTSAudioFileServerMediaSubsession::createNewRTPSink function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service DoS via supplying a crafted ADTS file...

CVE-2025-65405

A use-after-free in the ADTSAudioFileSource::samplingFrequency function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service DoS via supplying a crafted ADTS/AAC file...

CVE-2025-64775

Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue...

CVE-2025-65404

A buffer overflow in the getSideInfo2 function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service DoS via a crafted MP3 stream...

China Systems Eximbills Enterprise 安全漏洞

China Systems Eximbills Enterprise is a trade finance system from China Systems, a Chinese company. A security vulnerability exists in China Systems Eximbills Enterprise version 4.1.5, which stems from an uncleaned user input for the TMPLINFO parameter and could lead to a stored cross-site...

Linux Distros Unpatched Vulnerability : CVE-2025-13674

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BPv7 dissector crash in Wireshark 4.6.0 allows denial of service CVE-2025-13674 Note that Nessus relies on the presence of the package as reported by the vendor...

CVE-2025-13469

A security vulnerability has been detected in Public Knowledge Project omp and ojs 3.3.0/3.4.0/3.5.0. Impacted is an unknown function of the file plugins/paymethod/manual/templates/paymentForm.tpl of the component Payment Instructions Setting Handler. The manipulation of the argument...