Insufficient Session Expiration

Overview apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Insufficient Session Expiration. An authenticated user can continue using an already-logged-in session after the password of the user has...

LangChain < 0.0.27 SSRF

The version of LangChain installed on the remote host is prior to 0.0.27. It is, therefore, affected by a server-side request forgery SSRF vulnerability in the function loadlocal in the library libs/community/langchaincommunity/retrievers/tfidf.py of the component TFIDFRetriever. Note that Nessus...

IBM MQ 9.3 < 9.3.0.26 LTS / 9.4 < 9.4.0.7 LTS / 9.3 < 9.4.0.7 CD Password Disclosure (7178086)

The version of IBM MQ Server running on the remote host is affected by a vulnerability as referenced in the 7178086 advisory. - IBM MQ Appliance 9.3 LTS, 9.3 CD, and 9.4 LTS web console could allow a remote attacker to obtain sensitive information when a detailed technical error message is...

CVE-2024-56332

Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service DoS attack that allows attackers to construct requests that leaves requests to Server Actions hanging...

CVE-2024-56332 Next.js Vulnerable to Denial of Service (DoS) with Server Actions

Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service DoS attack that allows attackers to construct requests that leaves requests to Server Actions hanging...

CVE-2024-56514

Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, both in karmadactl and karmada-operator, it is possible to supply a filesystem path, or an HTTPs URL to retrieve the custom resourc...

CVE-2025-21610

Trix is vulnerable to cross-site scripting (XSS) in versions prior to 2.1.12 when a user pastes a malicious javascript: URL into the link field. An attacker could entice a user to copy&paste such a link, causing arbitrary JavaScript execution in the user’s session. A patch exists in Trix v2.1.12 ...

CVE-2025-21610 Trix allows Cross-site Scripting via `javascript:` url in a link

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.12 are vulnerable to cross-site scripting when pasting malicious code in the link field. An attacker could trick the user to copy&paste a malicious javascript: URL as a link that would execute...

CVE-2024-56514 Karmada Tar Slips in CRDs archive extraction

Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, both in karmadactl and karmada-operator, it is possible to supply a filesystem path, or an HTTPs URL to retrieve the custom resourc...

CVE-2024-56514

CVE-2024-56514 describes a TarSlip vulnerability in Karmada prior to v1.12.0 where CRDs downloaded from a filesystem path or HTTP(S) URL could be extracted from a gzipped tarfile and write arbitrary files. The flaw occurs when karmadactl or karmada-operator processes CRD archives during initializ...

CVE-2024-56514 Karmada Tar Slips in CRDs archive extraction

Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, both in karmadactl and karmada-operator, it is possible to supply a filesystem path, or an HTTPs URL to retrieve the custom resourc...

PT-2025-4298 · Trix · Trix

Name of the Vulnerable Software and Affected Versions: Trix editor versions prior to 2.1.12 Description: Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. The issue arises when pasting malicious code in the link field, allowing an attacker to trick the user into copyin...

Security Bulletin: Vulnerability in follow-redirects-1.15.3.tgz affects IBM Db2 Big SQL

Summary A vulnerability in node.js follow-redirects-1.15.3.tgz package affects I|BM Db2 Big SQL 7.6 and earlier on Cloud Pak for Data 4.8 and earlier. Vulnerability Details CVEID:CVE-2023-26159 DESCRIPTION: follow-redirects could allow a remote attacker to conduct phishing attacks, caused by an...

PT-2025-3202 · Unknown · Hestia Nginx Cache

Name of the Vulnerable Software and Affected Versions: Hestia Nginx Cache versions through 2.4.0 Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels. Recommendations: For versions through...

PT-2025-52559

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1:1.39.17-1deb12u1 MediaWiki versions prior to 1:1.43.6+dfsg-1deb13u1 Description Several security weaknesses exist in MediaWiki, a collaborative website engine. These issues could lead to cross-site scripting,...

PT-2025-52556

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1:1.39.17-1deb12u1 MediaWiki versions prior to 1:1.43.6+dfsg-1deb13u1 Description Multiple security issues were identified in MediaWiki, a website engine used for collaborative work. These issues could lead to...

PT-2025-54191

Name of the Vulnerable Software and Affected Versions Composer versions prior to 2.2.26 Composer versions prior to 2.9.3 Description Composer, a dependency manager for PHP, may allow attackers who control remote sources from which Composer downloads to inject ANSI control characters into the...

PT-2025-54919

Name of the Vulnerable Software and Affected Versions Dovecot versions prior to 2.4.3 Description A flaw exists in the ManageSieve AUTHENTICATE command that causes the service to crash when a literal value is used as the SASL initial response. This can lead to repeated crashes, resulting in a...

PT-2025-52557

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1:1.39.17-1deb12u1 MediaWiki versions prior to 1:1.43.6+dfsg-1deb13u1 Description Multiple security issues were identified in MediaWiki, a website engine used for collaborative work. These issues could lead to...

PT-2025-52664

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.111 Description The Linux kernel contains a data race condition within the do raw write lock function, specifically related to spinlock debugging. Kernel Concurrency Sanitizer KCSAN has identified a race...