CuteFlow security vulnerability

CuteFlow is a web-based document flow and workflow tool from CuteFlow, Inc. A security vulnerability exists in CuteFlow 2.11.2 and earlier versions, which stems from the restartcirculationvalueswrite.php script that does not validate the file type, which could lead to arbitrary file uploads and...

kernel: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command

A flaw was found in the Linux kernel's USB storage driver. When processing identification data for ISD200 devices, the driver does not verify that reported sector and head counts are greater than zero before performing division operations. A local attacker who connects a specially crafted or...

Check Point Management Log Server security vulnerabilities

Check Point Management Log Server is a log server from Check Point Israel. A security vulnerability exists in Check Point Management Log Server that stems from a lack of TLS authentication when downloading CSV files...

CLSA-2025-1754411479 Fix CVE(s): CVE-2025-48384

SECURITY UPDATE: security vulnerability - debian/patches/CVE-2025-48384.patch: quote values containing CR character in config to prevent unintended stripping of CR - CVE-2025-48384...

Malware in epic-fortnite-shared-values

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview epic-fortnite-shared-values is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

SUSE-SU-2025:02350-2 Security update for kubernetes1.28

This update for kubernetes1.28 fixes the following issues: - CVE-2025-22872: Properly handle trailing solidus in unquoted attribute value in foreign content bsc1241865...

PYSEC-2025-183

pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement...

CVE-2025-54752

Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it as a CSV file and opens it in the user's environment, the embedded code may be executed...

Alfasado PowerCMS security vulnerabilities

Alfasado PowerCMS is a content management system CMS from Alfasado Japan. A security vulnerability exists in Alfasado PowerCMS that stems from improper handling of CSV files, which could lead to the execution of embedded code...

Malicious code in epic-fortnite-shared-values (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1673c5a65d3d81e0cbfe67ef5df8558add71a1993f06838d744058afa38e3ce Any computer that has this package installed or running should be considered...

MAL-2025-6681 Malicious code in epic-fortnite-shared-values (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1673c5a65d3d81e0cbfe67ef5df8558add71a1993f06838d744058afa38e3ce Any computer that has this package installed or running should be considered...

Django CSV File Processor Code Execution

The vulnerability of the Django web application development platform’s CSV file processor is related to an incorrect path limitation for the restricted access directory. Exploiting this vulnerability allows a malicious actor to inject arbitrary code by introducing it into a specially crafted CSV...

Sensitive Information Disclosure

github.com/goharbor/harbor is vulnerable to Sensitive Information Disclosure. The vulnerability is due to an ORM leak caused by improper filtering logic in the /api/v2.0/users endpoint, allowing administrators to extract password hash and salt values using the q URL parameter...

git: Git arbitrary code execution

A line-end handling flaw was found in Git. When writing a config entry, values with a trailing carriage return CR are not quoted, resulting in the CR being lost when the config is read later. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read,...

git: Git arbitrary code execution

A line-end handling flaw was found in Git. When writing a config entry, values with a trailing carriage return CR are not quoted, resulting in the CR being lost when the config is read later. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read,...

CLSA-2025-1753207140 Fix CVE(s): CVE-2025-48384

SECURITY UPDATE: security vulnerability discovered - debian/patches/CVE-2025-48384.patch: quote values containing CR character in config to prevent unintentional stripping when reading - CVE-2025-48384...

git: Git arbitrary code execution

A line-end handling flaw was found in Git. When writing a config entry, values with a trailing carriage return CR are not quoted, resulting in the CR being lost when the config is read later. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read,...

SUSE CVE-2025-7783

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution HPP. This vulnerability is associated with program files lib/formdata.Js. This issue affects form-data: 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3...

CLSA-2025-1753121050 Fix CVE(s): CVE-2025-48384

SECURITY UPDATE: security vulnerability addressed - debian/patches/CVE-2025-48384.patch: quote values containing CR character to prevent unintended behavior - CVE-2025-48384...