ALSA-2025:11533 Important: git security update

Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to wo...

Improper Access Control

Directus is vulnerable to Improper Access Control. The vulnerability is due to manual trigger Flows not validating user permissions for the payload items, which allows an attacker to execute unauthorized tasks or access restricted collections/items without proper authentication or access rights...

CVE-2025-6719 Terms descriptions <= 3.4.8 - Authenticated (Admin+) Stored Cross-Site Scripting

The Terms descriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

SUSE SLES12: MozillaFirefox / MozillaFirefox-branding-SLE / MozillaFirefox-devel / etc (SUSE-SU-2025:02339-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02339-1 advisory. This is the Firefox Extended Support Release 140.0esr ESR Major changes: General: - Reader View now has an enhanced Text and Layout menu with...

CVE-2025-53742

Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

CVE-2025-53666

Jenkins Dead Man's Snitch Plugin 0.1 stores Dead Man's Snitch tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

CVE-2025-27028

The Linux deprivileged user vpuser in Radiflow iSAP Smart Collector CentOS 7 - VSAP 1.20 can read the entire file system content, including files belonging to other users and having restricted access like, for example, the root password hash...

WordPress Red Art Code Injection Vulnerability

WordPress Red Art is a theme designed for the art field, mainly used to create artist portfolios, galleries, photography exhibitions, tattoo studios and other art websites. WordPress Red Art suffers from a code injection vulnerability that stems from deserializing untrustworthy data, which can be...

CVE-2025-53668

The CVE concerns Jenkins VAddy Plugin prior to 1.2.9. The plugin stores Vaddy API Auth Keys unencrypted in job config.xml files on the Jenkins controller, enabling access by users with Item/Extended Read permission or anyone with filesystem access to the controller. The root cause is unencrypted ...

CVE-2025-53666

Jenkins Dead Man's Snitch Plugin 0.1 stores Dead Man's Snitch tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

CVE-2025-53664

Jenkins Apica Loadtest Plugin 1.10 and earlier stores Apica Loadtest LTP authentication tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

CVE-2025-27028

The CVE-2025-27028 entry concerns Radiflow iSAP Smart Collector (CentOS 7, VSAP 1.20). A deprivileged Linux user vpuser can read the entire filesystem, exposing restricted files (e.g., root password hash). Affected component is the file system access for vpuser; root cause details are not provide...

CVE-2025-49726 Windows Notification Elevation of Privilege Vulnerability

...

CVE-2025-42961

Due to a missing authorization check in SAP NetWeaver Application server for ABAP, an authenticated user with high privileges could exploit the insufficient validation of user permissions to access sensitive database tables. By leveraging overly permissive access configurations, unauthorized...

CVE-2025-42961 Missing Authorization check in SAP NetWeaver Application Server for ABAP

Due to a missing authorization check in SAP NetWeaver Application server for ABAP, an authenticated user with high privileges could exploit the insufficient validation of user permissions to access sensitive database tables. By leveraging overly permissive access configurations, unauthorized...

Sudo 1.9.17 Host Option - Elevation of Privilege

Exploit Title: Sudo 1.9.17 Host Option - Elevation of Privilege Date: 2025-06-30 Exploit Author: Rich Mirch Vendor Homepage: https://www.sudo.ws Software Link: https://www.sudo.ws/dist/sudo-1.9.17.tar.gz Version: Stable 1.9.0 - 1.9.17, Legacy 1.8.8 - 1.8.32 Fixed in: 1.9.17p1 Vendor Advisory:...

[SECURITY] Fedora 42 Update: sudo-1.9.17-2.p1.fc42

Sudo superuser do allows a system administrator to give certain users or groups of users the ability to run some or all commands as root while logging all commands and arguments. Sudo operates on a per-command basis. It is not a replacement for the shell. Features include: the ability to restrict...

BIT-DISCOURSE-2025-49845 Discourse users are able to see their own whispers even after being removed from a group that has been configured to see whispers

Discourse is an open-source discussion platform. The visibility of posts typed whisper is controlled via the whispersallowedgroups site setting. Only users that belong to groups specified in the site setting are allowed to view posts typed whisper. However, it has been discovered that users of...

Important: sudo security update

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fixes: sudo: LPE via host option CVE-2025-32462 For...

EulerOS 2.0 SP13 : docker-engine (EulerOS-SA-2025-1700)

According to the versions of the docker-engine packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers...