Security update for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-prometheus-prometheus was updated to version 2.53.4: Security issues fixed: CVE-2023-45288: Require Go = 1.23 for building bsc1236516 CVE-2025-22870: Bumped golang.org/x/net to version 0.39.0 bsc1238686 Other bugs fixes from version 2.53.4:...

PT-2025-26207 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.2 Description: A SQL Injection issue was identified in the id parameter of the "/WeGIA/controle/control.php" endpoint, allowing attackers to manipulate SQL queries and access sensitive database information, such as...

PT-2025-26166 · Couchbase · Couchbase .Net Sdk

Name of the Vulnerable Software and Affected Versions: Couchbase .NET SDK versions prior to 3.7.1 Description: The issue concerns the Couchbase .NET SDK's failure to properly enable hostname verification for TLS certificates. Additionally, the SDK was using IP addresses instead of hostnames due t...

PT-2025-25772 · WordPress · Tarteaucitron.Io

Name of the Vulnerable Software and Affected Versions: tarteaucitron.io WordPress plugin versions prior to 1.9.5 Description: The issue concerns the tarteaucitron.io WordPress plugin, which uses query parameters from YouTube oEmbed URLs without proper sanitization. This could allow users with the...

PT-2025-25971 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.19.0-yocto-standard+ Description: A vulnerability in the Linux kernel has been resolved, related to the powerpc/pci component. The issue arises from the get phb number function, which causes a DEBUG ATOMIC SLE...

PT-2025-26172 · Quiche · Quiche

Name of the Vulnerable Software and Affected Versions: quiche versions prior to 0.24.4 Description: The issue is related to incorrect congestion window growth, which could cause quiche to send data at a rate faster than the path might actually support. An unauthenticated remote attacker can explo...

CVE-2025-49843

The CVE-2025-49843 issue affects conda-smithy prior to version 3.47.1, where the travis_headers function creates files with permissions exceeding 0o600, potentially allowing read/write access beyond the intended user. This weakens least-privilege protections and could let an attacker access confi...

CVE-2025-49842 conda-forge-webservices Privilege Escalation Risk via Default Docker Root User

conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. Prior to version 2025.3.24, the condaforgewebservice Docker container executes commands without specifying a user. By default, Docker containers run as the root user, which increases the risk of privile...

PT-2025-25685 · WordPress · Track+

Name of the Vulnerable Software and Affected Versions: Track, Analyze & Optimize by WP Tao versions 1.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS. Recommendations:...

PT-2025-25717 · Cyberchimps · Cyberchimps Responsive Plus

Name of the Vulnerable Software and Affected Versions: CyberChimps Responsive Plus versions 3.2.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For versions 3.2....

PT-2025-25678 · Nasa Core · Nasa Core

Name of the Vulnerable Software and Affected Versions: Nasa Core versions through 6.3.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations: For versions through 6.3.2, update...

PT-2025-25670 · Wpdistillery · Wpdistillery Navigation Tree Elementor

Name of the Vulnerable Software and Affected Versions: wpdistillery Navigation Tree Elementor versions 1.0.1 and earlier Description: The issue is related to an SQL Injection vulnerability, specifically Improper Neutralization of Special Elements used in an SQL Command. This allows for Blind SQL...

PT-2025-25730 · Unknown · If-So Dynamic Content Personalization

Name of the Vulnerable Software and Affected Versions: If-So Dynamic Content Personalization versions 1.9.3.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks...

PT-2025-25623 · WordPress · Ivory Search

Name of the Vulnerable Software and Affected Versions: The Ivory Search WordPress plugin versions prior to 5.5.10 Description: The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and escape...

PT-2025-25667 · WordPress · Suhas Surse Wp Employee Attendance System

Name of the Vulnerable Software and Affected Versions: Suhas Surse WP Employee Attendance System versions 3.5 and earlier Description: The issue is related to an SQL Injection vulnerability, specifically Improper Neutralization of Special Elements used in an SQL Command. This allows for Blind SQL...

PT-2025-25753 · Unknown · Microlight.Js

Name of the Vulnerable Software and Affected Versions: microlight.js version 0.0.7 Description: A null pointer dereference issue was discovered in a lightweight syntax highlighting library. The library fails to validate the result of a regular expression match before accessing its properties when...

PT-2025-25731 · Metagauss · Metagauss Profilegrid

Name of the Vulnerable Software and Affected Versions: Metagauss ProfileGrid versions through 5.9.5.2 Description: The issue is a Server-Side Request Forgery SSRF vulnerability that allows Server Side Request Forgery. Recommendations: For Metagauss ProfileGrid versions through 5.9.5.2, update to ...

PT-2025-25645 · WordPress · The Master Slider

Name of the Vulnerable Software and Affected Versions: The Master Slider – Responsive Touch Slider plugin for WordPress versions up to, and including, 3.10.8 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplie...

CVE-2025-32798

Conda-build contains commands and tools to build conda packages. Prior to version 25.4.0, the conda-build recipe processing logic has been found to be vulnerable to arbitrary code execution due to unsafe evaluation of recipe selectors. Currently, conda-build uses the eval function to process...

TencentOS Server 4: python3.12 (TSSA-2025:0173)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0173 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...