CVE-2025-53909

CVE-2025-53909 affects mailcow: dockerized. A Server-Side Template Injection (SSTI) exists in the quota/quarantine notification template rendering system, allowing template expressions to be abused to execute code in certain contexts. The issue requires admin-level access to configure templates, ...

SUSE-SU-2025:02340-1 Security update for gnutls

This update for gnutls fixes the following issues: - CVE-2025-6395: Fix NULL pointer dereference when 2nd Client Hello omits PSK bsc1246299 - CVE-2025-32988: Fix double-free due to incorrect ownership handling in the export logic of SAN entries containing an otherName bsc1246232 - CVE-2025-32989:...

mailcow: dockerized 安全漏洞

mailcow: dockerized is a dockerized mailcow application from mailcow open source. A security vulnerability exists in versions prior to mailcow: dockerized 2025-07 that stems from a server-side template injection in the notification template system that could lead to code execution...

IDFace: Face Template Protection for Efficient and Secure Identification

As face recognition systems FRS become more widely used, user privacy becomes more important. A key privacy issue in FRS is protecting the user's face template, as the characteristics of the user's face image can be recovered from the template. Although recent advances in cryptographic tools such...

PT-2025-29910 · Mailcow · Mailcow

Name of the Vulnerable Software and Affected Versions: mailcow: dockerized versions prior to 2025-07 Description: A Server-Side Template Injection SSTI vulnerability exists in the notification template system used for sending quota and quarantine alerts. The template rendering engine allows...

CVE-2025-53865

In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates devel and responsive...

DEBIAN-CVE-2025-53101

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's magick mogrify command, specifying multiple consecutive %d format specifiers in a filename template causes internal pointer arithmetic to...

UBUNTU-CVE-2025-53019

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's magick stream command, specifying multiple consecutive %d format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and...

UBUNTU-CVE-2025-53101

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's magick mogrify command, specifying multiple consecutive %d format specifiers in a filename template causes internal pointer arithmetic to...

Important: Red Hat Security Advisory: Red Hat Developer Hub 1.5.3 release.

Red Hat Developer Hub 1.5.3 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...

CVE-2025-53019

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's magick stream command, specifying multiple consecutive %d format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and...

Roundup is vulnerable to XSS through interactions between URLs and issue tracker templates

In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates devel and responsive...

GHSA-QXH9-QMF2-RHWC Roundup is vulnerable to XSS through interactions between URLs and issue tracker templates

In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates devel and responsive...

Cross-site Scripting (XSS)

Overview roundup is a simple-to-use and -install issue-tracking system with command-line, web and e-mail interfaces. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the interaction between URLs and issue tracker templates. An attacker can execute arbitrary scripts...

PYSEC-2025-69

In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates devel and responsive...

PYSEC-2025-69

In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates devel and responsive...

CVE-2025-53865

In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates devel and responsive...

UBUNTU-CVE-2025-53865

In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates devel and responsive...

CVE-2025-53865

Vulnerability details (CVE-2025-53865): Roundup before 2.5.0 is vulnerable to cross-site scripting via the interaction between URLs and issue-tracker templates (devel and responsive). Affected component: Roundup up to version 2.4.x; root cause: XSS caused by URL/template interaction. Practical im...

CVE-2025-53865

In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates devel and responsive...