CVE-2025-27404

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of tha...

CVE-2025-29768 affecting package vim for versions less than 9.1.1198-1

CVE-2025-29768 affecting package vim for versions less than 9.1.1198-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-30211 KEX init error results with excessive memory usage

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names 64 characters provided in K...

CVE-2025-30372

CVE-2025-30372 concerns Emlog Pro vulnerable versions pro-2.5.7 and pro-2.5.8 to an SQL injection due to missing addslashes after urldecode, allowing bypass via URL double encoding and risking leakage of sensitive user data. The root cause is lack of proper input sanitization in search_controller...

GHSA-76G3-38JV-WXH4 tough timestamp metadata is cached when it fails snapshot rollback check

Summary TUF repositories use the timestamp role to protect against rollback events by enabling an automated process to periodically sign the role's metadata. While tough will ensure that the version of snapshot metadata in new timestamp metadata files was always greater than or equal to the...

[SECURITY] Fedora 40 Update: libssh2-1.11.1-1.fc40

libssh2 is a library implementing the SSH2 protocol as defined by Internet Drafts: SECSH-TRANS22, SECSH-USERAUTH25, SECSH-CONNECTION23, SECSH-ARCH20, SECSH-FILEXFER06, SECSH-DHGEX04, and SECSH-NUMBERS10...

SUSE-SU-2025:20255-1 Security update for python-requests

This update for python-requests fixes the following issues: - Add patch to inject the default CA bundles if they are not specified. bsc1226321, bsc1231500 - Remove Requires on python-py. - update to 2.32.3: Fixed bug breaking the ability to specify custom SSLContexts in sub-classes of HTTPAdapter...

CVE-2025-30365 SQL Injection in query_geracao_auto.php

WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.8 in the endpoint /WeGIA/html/socio/sistema/controller/querygeracaoauto.php, specifically in the query parameter. This vulnerability allows the execution of arbitrary SQL...

CVE-2025-30364 WeGIA vulnerable to SQL Injection (Blind Time-Based) in remuneracao.php parameter id_funcionario

WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.8 in the endpoint /WeGIA/html/funcionario/remuneracao.php, in the idfuncionario parameter. This vulnerability allows the execution of arbitrary SQL commands, which can...

CVE-2025-30363

WeGIA is a web management platform for charitable organizations that contains a stored XSS vulnerability in versions prior to 3.2.6. The issue allows attacker-supplied scripts to be preserved on the server and executed in users’ browsers when affected pages load. The vulnerability is fixed in ver...

CVE-2025-30362 WeGIA vulnerable to Stored XSS in documentos_funcionario.php parameter id

WeGIA is a Web manager for charitable institutions. A stored Cross-Site Scripting XSS vulnerability was identified in versions prior to 3.2.8. This vulnerability allows unauthorized scripts to be executed within the user's browser context. Stored XSS is particularly critical, as the malicious cod...

CVE-2025-30361 WeGIA Vulnerable to Broken Authentication - Old Password Validation

WeGIA is a Web manager for charitable institutions. A security vulnerability was identified in versions prior to 3.2.6, where it is possible to change a user's password without verifying the old password. This issue exists in the control.php endpoint and allows unauthorized attackers to bypass...

CVE-2025-27793 Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 5.32.0, corresponding to vega-functions prior to version 5.17.0, users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code...

CVE-2025-26619 Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode `expressionInterpeter`

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In vega 5.30.0 and lower and in vega-functions 5.15.0 and lower , it was possible to call JavaScript functions from the Vega expression language that were not meant to be...

CVE-2025-0811

CVE-2025-0811 affects GitLab CE/EE, across all versions from 17.7 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. The issue is an improper rendering of certain file types that leads to cross-site scripting. Available connected documents corroborate the affected product/version range ...

openSUSE Security Advisory (SUSE-SU-2025:1007-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-13417 · Dell · Dell Unity

Name of the Vulnerable Software and Affected Versions: Dell Unity versions 5.4 and prior Description: The issue is related to an Improper Neutralization of Special Elements used in an OS Command, also known as 'OS Command Injection'. This could allow a low-privileged attacker with local access to...

PT-2025-13067 · WordPress · Wp Subscription Forms

Name of the Vulnerable Software and Affected Versions: WP Subscription Forms versions 1.2.3 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-13104 · Themify · Themify Event Post

Name of the Vulnerable Software and Affected Versions: Themify Event Post versions 1.3.2 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local Fi...

PT-2025-13383 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.6 Description: A stored Cross-Site Scripting XSS issue was identified, allowing unauthorized scripts to be executed within the user's browser context. This type of XSS is particularly critical because the malicious...