CVE-2025-53355 mcp-server-kubernetes vulnerable to command injection in several tools

MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. A command injection vulnerability exists in the mcp-server-kubernetes MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to childprocess.execSync, enabling ...

ALPINE-CVE-2025-48384

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed CRLF. When writing a config entry, values with ...

CVE-2025-53545 Press has a potential 2FA bypass

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS. Users can circumvent 2FA login for users due to a lack of server side validation for the same. This vulnerability is fixed in commit...

KB5058716 - Description of the security update for SQL Server 2017 GDR: July 8, 2025

None None...

UBUNTU-CVE-2025-38237

In the Linux kernel, the following vulnerability has been resolved: media: platform: exynos4-is: Add hardware sync wait to fimcishwchangemode In fimcishwchangemode, the function changes camera modes without waiting for hardware completion, risking corrupted data or system hangs if subsequent...

CVE-2025-38237 media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()

In the Linux kernel, the following vulnerability has been resolved: media: platform: exynos4-is: Add hardware sync wait to fimcishwchangemode In fimcishwchangemode, the function changes camera modes without waiting for hardware completion, risking corrupted data or system hangs if subsequent...

CVE-2025-38236 af_unix: Don't leave consecutive consumed OOB skbs.

In the Linux kernel, the following vulnerability has been resolved: afunix: Don't leave consecutive consumed OOB skbs. Jann Horn reported a use-after-free in unixstreamreadgeneric. The following sequences reproduce the issue: $ python3 from socket import s1, s2 = socketpairAFUNIX, SOCKSTREAM...

PT-2025-29220 · Apache · Apache Http Server

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server affected versions not specified Description: A flaw exists that may allow unauthenticated remote code execution when a malicious folder is created via the web interface HTTP when it is enabled. HTTP is disabled by default...

PT-2025-28305 · Jhenggao · Ipublish System

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined, as the descriptions do not specify the software name and version. Description: The issue allows unauthenticated remote attackers to read arbitrary system files. Recommendations: At the moment, there is n...

PT-2025-28730 · Irfanview · Irfanview

Name of the Vulnerable Software and Affected Versions: IrfanView CADImage Plugin affected versions not specified Description: The IrfanView CADImage Plugin contains a flaw in the parsing of DWG files due to insufficient validation of user-supplied data. This can lead to a memory corruption...

PT-2025-28556 · Microsoft · Windows Nt Rras +1

Name of the Vulnerable Software and Affected Versions: Windows Routing and Remote Access Service RRAS affected versions not specified Description: The issue is related to a heap-based buffer overflow in the Windows Routing and Remote Access Service RRAS, which allows an unauthorized attacker to...

PT-2025-28729 · Irfanview · Irfanview

Name of the Vulnerable Software and Affected Versions: IrfanView CADImage Plugin affected versions not specified Description: The IrfanView CADImage Plugin contains a flaw in the parsing of DWG files due to insufficient validation of user-supplied data. This can lead to a memory corruption...

PT-2025-28538 · Microsoft · Mpeg-2 Video Extension +1

Name of the Vulnerable Software and Affected Versions: Microsoft MPEG-2 Video Extension affected versions not specified Description: The issue is related to a heap-based buffer overflow in the Microsoft MPEG-2 Video Extension, which allows an authorized attacker to execute code locally...

PT-2025-28782

Name of the Vulnerable Software and Affected Versions: Adobe Framemaker versions 2020.8, 2022.6 and earlier Description: The issue is an Integer Underflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user...

PT-2025-28352 · Phoenix Contact · Axc F 1152 +4

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute access to any file on the device...

jq security update

1.6-17.el9.2 - Fix CVE-2025-48060 - Resolves: RHEL-92990 1.6-17.el9.1 - Fix CVE-2024-23337 - Resolves: RHEL-92972 1.6-17 - Fix SAST findings in jq 1.6 - Resolves: RHEL-28653 1.6-16 - Make jq 1.6 fast - Resolves: RHEL-13431...

PT-2025-28718 · Irfanview · Irfanview

Name of the Vulnerable Software and Affected Versions: IrfanView CADImage Plugin affected versions not specified Description: The IrfanView CADImage Plugin contains a flaw in the parsing of DXF files due to insufficient validation of user-supplied data. This can lead to a memory corruption...

Security Bulletin: The Dashboard UI of IBM Sterling B2B Integrator and IBM Sterling File Gateway is Vulnerable to Cross-Site Scripting (CVE-2025-2793)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the Cross-Site Scripting vulnerability Vulnerability Details CVEID:CVE-2025-2793 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition is vulnerable to cross-site scripting. This vulnerability allows an...

CVE-2025-53543

CVE-2025-53543 : Kestra (event-driven orchestration platform) is vulnerable to a stored XSS in the error message shown on the execution “Overview” tab due to improper handling of HTTP responses. This issue is addressed in Kestra 0.22.0 and later. Remediation: upgrade to 0.22.0+ (or apply vendor-p...

CVE-2025-53536 Roo Code allows Potential Remote Code Execution via .vscode/settings.json

Roo Code is an AI-powered autonomous coding agent. Prior to 3.22.6, if the victim had "Write" auto-approved, an attacker with the ability to submit prompts to the agent could write to VS Code settings files and trigger code execution. There were multiple ways to achieve that. One example is with...