EUVD-2023-1657

Malicious code in bioql PyPI...

EUVD-2022-5644

Malicious code in bioql PyPI...

EUVD-2025-14509

Malicious code in bioql PyPI...

CVE-2025-59933

libvips is a demand-driven, horizontally threaded image processing library. For versions 8.17.1 and below, when libvips is compiled with support for PDF input via poppler, the pdfload operation is affected by a buffer read overflow when parsing the header of a crafted PDF with a page that defines...

Security update for podman

This update for podman fixes the following issues: CVE-2025-6032: Fixed machine init command failing to verify TLS certificate bsc1245320 Fix conditional Requires remove deprecated sleversion macro Update to version 5.4.2: Add release notes for v5.4.2 Fix a potential deadlock during podman cp...

rke2-1.33-1.33.5+rke2r1-1.1 on GA media (moderate)

rke2-1.33-1.33.5+rke2r1-1.1 on GA media Announcement ID: openSUSE-SU-2025:15569-1 Rating: moderate Cross-References: CVE-2025-1974 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

CVE-2025-10619

A vulnerability was detected in sequa-ai sequa-mcp up to 1.0.13. This affects the function redirectToAuthorization of the file src/helpers/node-oauth-client-provider.ts of the component OAuth Server Discovery. Performing manipulation results in os command injection. Remote exploitation of the...

PT-2025-38372

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.0-rc4 for upstream base 2022 11 10 16 12 1 Description A flaw exists in the Linux kernel's RDMA/mlx5 subsystem related to the handling of port numbers within the mlx5 ib get hw stats function. Specifically,...

PT-2025-38233

Name of the Vulnerable Software and Affected Versions: CISA Thorium versions prior to 1.1.2 Description: CISA Thorium does not validate TLS certificates when connecting to Elasticsearch. This allows an unauthenticated attacker with access to a Thorium cluster to impersonate the Elasticsearch...

GHSA-9G9J-RGGX-7FMG [email protected] contains malware after npm account takeover

Impact On 8 September 2025, the npm publishing account for simple-swizzle was taken over after a phishing attack. Version 0.2.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker'...

CVE-2025-59330

error-ex allows error subclassing and stack customization. On 8 September 2025, an npm publishing account for error-ex was taken over after a phishing attack. Version 1.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect...

Fedora 43 : cef (2025-6e40c0957f)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-6e40c0957f advisory. - Update to 139.0.7258.154 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

PT-2025-37402

Name of the Vulnerable Software and Affected Versions: CRMEB versions prior to 5.6.1 Description: A security issue exists in CRMEB that allows for server-side request forgery. The testOutUrl function within the app/services/out/OutAccountServices.php file is affected. Manipulation of the push tok...

Fedora 43 : chromium (2025-e8d34c61f8)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-e8d34c61f8 advisory. Update to 140.0.7339.80 CVE-2025-9864: Use after free in V8 CVE-2025-9865: Inappropriate implementation in Toolbar CVE-2025-9866: Inappropriate...

CVE-2025-59058

httpsig-rs is a Rust implementation of IETF RFC 9421 http message signatures. Prior to version 0.0.19, the HMAC signature comparison is not timing-safe. This makes anyone who uses HS256 signature verification vulnerable to a timing attack that allows the attacker to forge a signature. Version...

SUSE-SU-2025:03200-1 Security update for go1.25

This update for go1.25 fixes the following issues: Update to go1.25.1, released 2025-09-03 bsc1244485. Security issues fixed: - CVE-2025-47910: net/http: CrossOriginProtection insecure bypass patterns not limited to exact matches bsc1249141. Other issues fixed: - go74822 cmd/go: 'get...

SUSE-SU-2025:20746-1 Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues: Update to version 20250416.02 bsc1244304, bsc1244503 defaultSleeper: tolerate 10% difference to reduce test flakiness 810 Add output of some packagemanagers to the testdata 808 From version 20250416.01: Refactor OS Info package 809...

Fedora 42 : checkpointctl (2025-ba1dacf88c)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-ba1dacf88c advisory. Add python3-click build dependency ---- Update to upstream version 1.4.0 Tenable has extracted the preceding description block directly from the Fedora...

SUSE-SU-2025:03169-1 Security update for regionServiceClientConfigAzure

This update for regionServiceClientConfigAzure contains the following fixes: - Update to version 3.0.0. bsc1246995 + SLE 16 python-requests requires SSL v3 certificates. Update 2 region server certs to support SLE 16 when it gets released. - Update dependency name for metadata package, name chang...

SUSE-SU-2025:03159-1 Security update for go1.23-openssl

This update for go1.23-openssl fixes the following issues: Update to version 1.23.12 cut from the go1.23-fips-release branch at the revision tagged go1.23.12-1-openssl-fips. jscSLE-18320 Rebase to 1.23.12 Fix HKDF-Extract The latest OpenSSL in c9s/c10s requires nil salt to be passed as a hash...