CVE-2025-0509 Signing Checks Bypass

A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s EdDSA signing checks...

Mageia: Security Advisory (MGASA-2025-0034)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

owasp-modsecurity-crs-4.10.0-1.1 on GA media (moderate)

owasp-modsecurity-crs-4.10.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:14717-1 Rating: moderate Cross-References: CVE-2023-5003 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

Debian: Security Advisory (DLA-4032-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress Automate Hub Free by Sperse.IO plugin <= 1.7.0 - Cross-Site Request Forgery to Activation Status Update vulnerability

Cross-Site Request Forgery to Activation Status Update vulnerability discovered by Dhabaleshwar Das in WordPress Plugin Automate Hub versions = 1.7.0...

Debian: Security Advisory (DLA-4030-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ruby3.4-rubygem-railties-8.0-8.0.1-1.1 on GA media (moderate)

ruby3.4-rubygem-railties-8.0-8.0.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:14680-1 Rating: moderate Cross-References: CVE-2024-54133 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in t...

CVE-2024-50349 affecting package git for versions less than 2.40.4-1

CVE-2024-50349 affecting package git for versions less than 2.40.4-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-21399

Microsoft Edge Chromium-based Update Elevation of Privilege Vulnerability...

CVE-2025-21399

Microsoft Edge Chromium-based Update Elevation of Privilege Vulnerability...

CVE-2025-21399

CVE-2025-21399 affects Microsoft Edge (Chromium-based) in the Update mechanism (Edge Update Setup). The vulnerability is an Elevation of Privilege leading to SYSTEM-level access in a local context. CVSS v3.1 base score 7.4 (HIGH) with local attack vector, high complexity, no user interaction, and...

CVE-2024-39608

A firmware update vulnerability exists in the login.cgi functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary firmware update. An attacker can send an unauthenticated message to trigger this vulnerability...

CVE-2024-39608

A firmware update vulnerability exists in the login.cgi functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary firmware update. An attacker can send an unauthenticated message to trigger this vulnerability...

CVE-2024-39273

A firmware update vulnerability exists in the fwcheck.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary firmware update. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...

CVE-2024-39608

CVE-2024-39608 is a reported unauthenticated firmware-upload vulnerability in the Wavlink AC3000 (M33A8.V5030.210505) login.cgi. Talos details show an unauthenticated HTTP POST can flash firmware to the device, with full device compromise risk (root access via missing authentication in the firmwa...

CVE-2024-39273

A firmware update vulnerability exists in the fwcheck.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary firmware update. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...

CVE-2024-12616 Bitly's WordPress Plugin <= 2.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update

The Bitlys WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 2.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

WordPress Bitly plugin <= 2.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update vulnerability

Missing Authorization to Authenticated Subscriber+ Settings Update vulnerability discovered by Lucio Sá in WordPress Plugin Bitly versions = 2.7.3...

Security update for python-django-ckeditor (moderate)

openSUSE Security Update: Security update for python-django-ckeditor Announcement ID: openSUSE-SU-2025:0008-1 Rating: moderate References: 1219720 Cross-References: CVE-2024-24815 Affected Products: openSUSE Backports SLE-15-SP5 An update that fixes one vulnerability is now available. Description...

CVE-2024-11946 iXsystems TrueNAS CORE fetch_plugin_packagesites tar Cleartext Transmission of Sensitive Information Vulnerability

iXsystems TrueNAS CORE fetchpluginpackagesites tar Cleartext Transmission of Sensitive Information Vulnerability. This vulnerability allows network-adjacent attackers to tamper with firmware update files on affected installations of iXsystems TrueNAS devices. Authentication is not required to...