CVE-2025-6776

CVE-2025-6776 affects xiaoyunjie openvpn-cms-flask (

CVE-2025-52569

GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 5.9.1 lack input validation of input validation for user-provided values in certain functions. In the GitHub.repo function, the user can provide any string for the reponame field. These inputs are not validate...

CVE-2025-52479

HTTP.jl provides HTTP client and server functionality for Julia, and URIs.jl parses and works with Uniform Resource Identifiers URIs. URIs.jl prior to version 1.6.0 and HTTP.jl prior to version 1.10.17 allows the construction of URIs containing CR/LF characters. If user input was not otherwise...

SUSE-SU-2025:02159-1 Security update for apache-commons-fileupload

This update for apache-commons-fileupload fixes the following issues: Upgrade to upstream version 1.6.0 - CVE-2025-48976: Fixed allocation of resources for multipart headers with insufficient limits can lead to a DoS bsc1244657. Full changelog:...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the execute function in the CliRuntimeRunner.java file, which is included in a command string and may be exposed in an error message if a command is not found. An attacker can obtain sensitive credential...

[SECURITY] [DSA 5951-1] icu security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5951-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 26, 2025 https://www.debian.org/security/faq -...

CVE-2025-49592 n8n Login Flow has Open Redirect Vulnerability

n8n is a workflow automation platform. Versions prior to 1.98.0 have an Open Redirect vulnerability in the login flow. Authenticated users can be redirected to untrusted, attacker-controlled domains after logging in, by crafting malicious URLs with a misleading redirect query parameter. This may...

CVE-2025-49592 n8n Login Flow has Open Redirect Vulnerability

n8n is a workflow automation platform. Versions prior to 1.98.0 have an Open Redirect vulnerability in the login flow. Authenticated users can be redirected to untrusted, attacker-controlled domains after logging in, by crafting malicious URLs with a misleading redirect query parameter. This may...

CVE-2025-49592

CVE-2025-49592 affects n8n up to version 1.97.x (prior to 1.98.0). The Open Redirect vulnerability exists in the login flow at /signin, where authenticated users can be redirected to attacker‑controlled domains via malicious redirect parameters, enabling phishing and potential credential/2FA thef...

Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens

Summary Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error logs with sensitive information. Please upgrade to v0.5.3 to resolve this issue. Th...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the processing of OpenID Connect tokens. An attacker can access internal network resources and potentially obtain sensitive information by submitting specially crafted tokens that trigger unauthorize...

CVE-2025-50213

Failure to Sanitize Special Elements into a Different Plane Special Element Injection vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added in...

CVE-2025-52569

CVE-2025-52569 concerns GitForge.jl/GitHub.jl prior to 5.9.1. The issue is lack of input validation in the GitHub.repo() function: the repo_name field accepts any string and is sent to the server without proper encoding, enabling path traversal patterns such as ../ to access unintended GitHub API...

CVE-2025-52483 Registrator.jl Vulnerable to Argument Injection and Command Injection

Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the clone URL returned by GitHub is malicious or can be injected using upstream vulnerabilities a shell script injection can occur within the...

Security Bulletin: Multiple vulnerabilities in IBM® SDK, Java™ Technology Edition affect IBM Storage Server (CVE-2025-1470, CVE-2025-1471).

Summary IBM Storage Protect Server is affected by multiple vulnerabilities in the IBM® SDK Java™ Technology Edition, Version 8. These vulnerabilities could potentially affect OpenJ9 internal ASCII to EBCDIC string wrapper on z/OS. Vulnerability Details CVEID:CVE-2025-1470 DESCRIPTION: In Eclipse...

[SECURITY] [DLA 4230-1] xorg-server security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4230-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort June 25, 2025 https://wiki.debian.org/LTS -...

Amazon Linux 2 : apache-commons-beanutils (ALAS-2025-2899)

The version of apache-commons-beanutils installed on the remote host is prior to 1.8.3-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2899 advisory. Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version...

GLSA-202506-03 : LibreOffice: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202506-03 LibreOffice: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in LibreOffice. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block...

CVE-2025-50213

Failure to Sanitize Special Elements into a Different Plane Special Element Injection vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added...

UNIX Symbolic Link (Symlink) Following

Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following via improper checks of a path's existence under the .git directory. An attacker can execute arbitrary commands with the privileges of the configured account in RUNUSER. By exploiting this flaw, an...