Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : MySQL vulnerabilities (USN-7245-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7245-1 advisory. Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issue...

GHSA-2MQW-RQ5M-8HC8 Snowflake.Data has weak temporary files permissions

Issue Snowflake discovered and remediated a vulnerability in the Snowflake Connector for .NET in which files downloaded from stages are temporarily placed in a world-readable local directory, making them accessible to unauthorized users on the same machine. This vulnerability affects versions...

CVE-2025-24793 Snowflake Connector for Python has an SQL Injection in write_pandas

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the...

CVE-2025-24884

The CVE-2025-24884 entry concerns kube-audit-rest, a simple logger for Kubernetes API mutations. When the here-described full-elastic-stack example vector is used, previous values of Kubernetes secrets could be disclosed in audit messages due to the logger capturing sensitive data. Fixed in versi...

SUSE-SU-2025:0291-1 Security update for iperf

This update for iperf fixes the following issues: - Update to version 3.18 - CVE-2024-53580: Fixed a segmentation violation via the iperfexchangeparameters function. bsc1234705...

CVE-2025-24792 Snowflake PHP PDO Driver has a Signed-to-Unsigned Conversion Error

Snowflake PHP PDO Driver is a driver that uses the PHP Data Objects PDO extension to connect to the Snowflake database. Snowflake discovered and remediated a vulnerability in the Snowflake PHP PDO Driver where executing unsupported queries like PUT or GET on stages causes a signed-to-unsigned...

Fedora 40 : dotnet8.0 (2025-16778d3c88)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-16778d3c88 advisory. This is the January 2025 security and bugfix release for .NET 8.0. It updates the SDK to version 8.0.112 and Runtime to version 8.0.12. Release Note...

Security Bulletin: IBM Security SOAR is using components with multiple known vulnerabilities (CVE-2024-47764)

Summary IBM Security SOAR uses an older version of the jshttp cookie UI component that may be identified and exploited. An update has been released which addresses these issues. It is recommended that customers upgrade to Version 51.0.4.1 or later of IBM Security SOAR. Vulnerability Details...

CVE-2024-50232 affecting package kernel for versions less than 6.6.64.2-1

CVE-2024-50232 affecting package kernel for versions less than 6.6.64.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-50072 affecting package kernel for versions less than 6.6.64.2-1

CVE-2024-50072 affecting package kernel for versions less than 6.6.64.2-1. An upgraded version of the package is available that resolves this issue...

PT-2025-1939 · WordPress · Infility Global Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Infility Global WordPress plugin versions 2.9.8 and earlier Description: The issue arises because the Infility Global WordPress plugin does not properly sanitise and escape a parameter before outputting it back in the page. This leads to a...

CVE-2025-22604

Cacti is an open source performance and fault management framework. Due to a flaw in multi-line SNMP result parser, authenticated users can inject malformed OIDs in the response. When processed by ssnetsnmpdiskio or ssnetsnmpdiskbytes, a part of each OID will be used as a key in an array that is...

PT-2025-5390 · Seedprod · Seedprod Coming Soon Page

Name of the Vulnerable Software and Affected Versions: SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd versions n/a through 6.18.9 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Cross Site Request Forgery. This problem affects th...

PT-2025-5293

Name of the Vulnerable Software and Affected Versions macOS versions prior to 15.3 iPadOS versions prior to 17.7.4 macOS Sonoma versions prior to 14.7.3 macOS Sequoia versions prior to 15.3 Description The issue is a race condition within the kauth cred proc update function of the macOS and iPadO...

PT-2025-1314 · Cacti +1 · Cacti +1

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.29 Description: Cacti is an open source performance and fault management framework. It has a SQL injection vulnerability in the template function of host templates.php using the graph template parameter. This issue...

PT-2025-02: Access to files or directories to external paties in TCPDF

The vulnerability was identified in TCPDF, version 6.8.0. The discovered vulnerability allows an attacker to transmit a specially created HTML file containing an image in Base64 format. Using the specified payload, the attacker can access an arbitrary image outside of the directory. Vulnerability...

PT-2025-1313 · Cacti +1 · Cacti +1

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.29 Description: Cacti is an open source performance and fault management framework. It has a SQL injection vulnerability in the get discovery results function of automation devices.php using the network parameter...

PT-2025-1376 · Libxml2 +9 · Libxml2 +9

The libxml2 library, specifically versions up to 2.10.x, contains a use-after-free flaw in the xmlXIncludeAddNode function within the xinclude.c file. This flaw can potentially lead to remote code execution. The affected versions are all libxml2 versions before 2.11.0. An exploit for this issue i...

CVE-2025-22612

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.374, the missing authorization allows an authenticated user to retrieve any existing private keys on a coolify instance in plain text. If the server configuration of IP ...

CVE-2025-24025 Coolify Vulnerable to Reflected XSS on Tag Search

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.380, the tags page allows users to search for tags. If the search does not return any results, the query gets reflected on the error modal, which leads to cross-site...