CVE-2025-38053

In the Linux kernel, the following vulnerability has been resolved: idpf: fix null-ptr-deref in idpffeaturescheck idpffeaturescheck is used to validate the TX packet. skb header length is compared with the hardware supported value received from the device control plane. The value is stored in the...

SUSE-SU-2025:01989-1 Security update for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-prometheus-prometheus was updated to version 2.53.4: - Security issues fixed: CVE-2023-45288: Require Go = 1.23 for building bsc1236516 CVE-2025-22870: Bumped golang.org/x/net to version 0.39.0 bsc1238686 - Other bugs fixes from version 2.53.4...

Photon OS 4.0: Linux PHSA-2025-4.0-0816

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-4.0-0816. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2025-6192

Use after free in Metrics in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Fedora 43 : jupyterlab / python-notebook (2025-7472c8fb5c)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-7472c8fb5c advisory. New jupyterlab and notebook Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

Photon OS 4.0: Systemd PHSA-2025-4.0-0817

An update of the systemd package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-4.0-0817. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2025-49593 Portainer HTTP Headers May Leak to Malicious Container Registries

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. Prior to STS version 2.31.0 and LTS version 2.27.7, if a Portainer administrator can be convinced to register a maliciou...

WhatsApp to start targeting you with ads

WhatsApp has announced that it will start to show you targeted ads on the app. The ads, it says, will appear under the Updates tab. WhatsApp launched the Updates tab a year ago, and now 1.5 billion people visit it every day. Updates has historically been a place for users to follow news and updat...

CGA-24QQ-2337-8X7J

Bulletin has no description...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.0 security and extras update

Red Hat OpenShift Container Platform release 4.19.0 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a security impact of...

CVE-2025-6199

A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length rather than the actual number of written bytes. This logic error results in uninitialized sections of the...

CGA-MJG9-H2JR-FQRQ

Bulletin has no description...

gimp:2.8 security update

gimp 2:2.8.22-26.2 - fix CVE-2025-5473 RHEL-95696 2:2.8.22-26.1 - fix CVE-2025-48797 RHEL-93503 - fix CVE-2025-48798 RHEL-93506 pygobject2 2.28.7-5 - bump spec to fix NVR pygtk2 2.24.0-25 - Fix shebang mangling for prefix=app 1907579 - disable numpy for flatpak 1907579 python2-pycairo 1.16.3-7 -...

Security Updates for Microsoft Word Products (June 2025)

The Microsoft Word Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2025-32717, CVE-2025-47168,...

Slackware Linux 15.0 / current xorg-server Multiple Vulnerabilities (SSA:2025-168-01)

The version of xorg-server installed on the remote host is prior to 1.20.14 / 21.1.17 / 21.1.4 / 24.1.7. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-168-01 advisory. New xorg-server packages are available for Slackware 15.0 and -current to fix security...

Alibaba Cloud Linux 3 : 0088: perl-FCGI:0.78 (ALINUX3-SA-2025:0088)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0088 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-40907: FCGI versions 0.44 through 0.82, fo...

PT-2025-25722 · Unknown · Ebook Store

Name of the Vulnerable Software and Affected Versions: Ebook Store versions n/a through 5.8008 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

container-tools:ol8 security update

aardvark-dns buildah 2:1.33.12-2 - update to the latest content of https://github.com/containers/buildah/tree/release-1.33 https://github.com/containers/buildah/commit/cf49e7c - fixes 'CVE-2025-22871 container-tools:rhel8/buildah: Request smuggling due to acceptance of invalid chunked data in...

Security Updates for Microsoft Office Products (June 2025)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2025-47164, CVE-2025-47167,...

GHSA-RVPW-P7VW-WJ3M OpenNext for Cloudflare (opennextjs-cloudflare) has a SSRF vulnerability via /_next/image endpoint

A Server-Side Request Forgery SSRF vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /next/image endpoint...