CVE-2025-48882

PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats. Prior to version 0.3.0, loading XML data using the standard libxml extension and the LIBXMLDTDLOAD flag without additional filtration, leads to XXE. Version 0.3.0 fixes the vulnerability...

PT-2025-23451 · Aruba · Aruba Wlan Sta Driver

Name of the Vulnerable Software and Affected Versions: Aruba WLAN STA Driver affected versions not specified Description: In the wlan STA driver, there is a possible system crash due to an uncaught exception. This could lead to local denial of service with User execution privileges needed. User...

nodejs-electron-35.5.0-1.1 on GA media (moderate)

nodejs-electron-35.5.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:15182-1 Rating: moderate Cross-References: CVE-2025-4609 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

curl-8.14.0-1.1 on GA media (moderate)

curl-8.14.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:15176-1 Rating: moderate Cross-References: CVE-2025-4947 CVE-2025-5025 CVSS scores: CVE-2025-4947 SUSE : 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N CVE-2025-4947 SUSE : 8.3...

SUSE SLES12 Security Update : postgresql14 (SUSE-SU-2025:01772-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:01772-1 advisory. Upgrade to 14.18: - CVE-2025-4207: Fixed PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validatio...

SUSE SLES15 Security Update : postgresql14 (SUSE-SU-2025:01786-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:01786-1 advisory. Upgrade to 14.18: - CVE-2025-4207: Fixed PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fail...

WordPress WP Guppy plugin <= 4.3.3 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin WP Guppy versions = 4.3.3...

Security Bulletin: The IBM® Engineering Lifecycle Engineering products using IBM WebSphere Application Server is affected by a cross-site scripting vulnerability (CVE-2025-33104)

Summary IBM WebSphere Application Server is affected by a cross-site scripting vulnerability. Following IBM® Engineering Lifecycle Engineering product is vulnerable to this attack, it has been addressed in this bulletin: IBM Engineering Test Management Vulnerability Details Refer to the security...

PT-2025-23337 · Unknown · Legion Space

Name of the Vulnerable Software and Affected Versions: Legion Space software affected versions not specified Description: An open debug interface in the Legion Space software could allow a local attacker to execute arbitrary code. Recommendations: At the moment, there is no information about a...

SUSE SLED15 / SLES15 Security Update : go1.24 (SUSE-SU-2025:01551-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:01551-1 advisory. Update to go1.24.3 bsc1236217: Security fixes: - CVE-2025-22873: Fixed os.Root permits access to parent directory...

SUSE SLED15: libecpg6 / libpq5 / libpq5-32bit / postgresql17 / etc (SUSE-SU-2025:01644-2)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:01644-2 advisory. Upgrade to 17.5: - CVE-2025-4207: Fixed PostgreSQL GB18030 encoding validation can read one byte past end of allocatio...

SUSE SLES12 Security Update : postgresql13 (SUSE-SU-2025:01750-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:01750-1 advisory. Upgrade to 13.21: - CVE-2025-4207: Fixed PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validatio...

CVE-2025-31189

A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to break out of its sandbox...

CVE-2025-46701

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1...

Chromium: CVE-2025-5283 Use after free in libvpx

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Important: Red Hat Security Advisory: pcs security update

An update for pcs is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

CVE-2025-37993

CVE-2025-37993 refers to a Linux kernel issue where the m_can_classdev.tx_handling_spinlock was not initialized during device probe, causing a spinlock bad magic crash (notably when cansend is used). The problem is resolved by initializing the spin lock in m_can_class_allocate_dev. Affected conte...

LSN-0112-1: Kernel Live Patch Security Notice

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix use-after-free due to delegation race A delegation break could arrive as soon as we've called vfssetlease. A delegation break runs a callback which immediately in nfsd4cbrecallprepare adds the delegation to delrecalllru...

Medium: python-requests

Issue Overview: Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to th...

Debian dla-4186 : php-twig - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4186 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4186-1 [email protected] https://www.debian.org/lts/security/...