SUSE SLES12 Security Update : docker (SUSE-SU-2025:1341-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:1341-1 advisory. - Update to docker-buildx v0.22.0 - CVE-2025-0495: Fixed an integer overflow in User ID handling in containerd. bsc1239765 Tenable has extracted the...

CVE-2025-3124

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a user to see the names of private repositories that they wouldn't otherwise have access to in the Security Overview in GitHub Advanced Security. The Security Overview was required to be filtered only...

CVE-2025-3509 Pre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege Escalation

A Remote Code Execution RCE vulnerability was identified in GitHub Enterprise Server that allowed attackers to execute arbitrary code by exploiting the pre-receive hook functionality, potentially leading to privilege escalation and system compromise. The vulnerability involves using dynamically...

CVE-2025-3509

CVE-2025-3509 affects GitHub Enterprise Server prior to 3.18 and is a Remote Code Execution in the pre-receive hook. The root cause involves using dynamically allocated ports that become temporarily available during specific operational conditions (e.g., hot patch upgrades), creating an exploitab...

CVE-2025-3124 Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized access to private repository names

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a user to see the names of private repositories that they wouldn't otherwise have access to in the Security Overview in GitHub Advanced Security. The Security Overview was required to be filtered only...

CLSA-2025-1744925221 gcc: Fix of CVE-2020-11023

CVE-2020-11023: Fix issue in DOM manipulation methods to prevent execution of untrusted code...

CVE-2021-47670

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: fix use after free bugs After calling peakusbnetifrxniskb, dereferencing skb is unsafe. Especially, the canframe cf which aliases skb memory is accessed after the peakusbnetifrxni. Reordering the lines solves the...

CVE-2021-47669

In the Linux kernel, the following vulnerability has been resolved: can: vxcan: vxcanxmit: fix use after free bug After calling netifrxniskb, dereferencing skb is unsafe. Especially, the canfdframe cfd which aliases skb memory is accessed after the netifrxni...

CVE-2021-47669 can: vxcan: vxcan_xmit: fix use after free bug

In the Linux kernel, the following vulnerability has been resolved: can: vxcan: vxcanxmit: fix use after free bug After calling netifrxniskb, dereferencing skb is unsafe. Especially, the canfdframe cfd which aliases skb memory is accessed after the netifrxni...

CVE-2020-36789 can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context

In the Linux kernel, the following vulnerability has been resolved: can: dev: cangetechoskb: prevent call to kfreeskb in hard IRQ context If a driver calls cangetechoskb during a hardware IRQ which is often, but not always, the case, the 'WARNONinirq' in net/core/skbuff.cskbreleaseheadstate might...

WordPress AdminQuickbar plugin <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin AdminQuickbar versions = 1.9.1...

WordPress WPCafe plugin <= 2.2.32 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by theviper17 Patchstack Alliance in WordPress Plugin WPCafe versions = 2.2.32...

WordPress Payment Form for PayPal Pro plugin <= 1.1.72 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Doan Dinh Van / Fore-Z co.ltd in WordPress Plugin Payment Form for PayPal Pro versions = 1.1.72...

PT-2025-16976 · Webbernaut · Webbernaut Cloak Front End Email

Name of the Vulnerable Software and Affected Versions: webbernaut Cloak Front End Email versions 1.9.5 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. This can be exploited in th...

PT-2025-17032 · Woocommerce · Akadrama Shipping With Venipak For Woocommerce

Name of the Vulnerable Software and Affected Versions: Akadrama Shipping with Venipak for WooCommerce versions 1.22.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : rubygem-bundler (SUSE-SU-2025:1294-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1294-1 advisory. - CVE-2020-36327: Fixed bundler choosing a dependency source based on the highest gem version number, whi...

subfinder-2.7.0-2.1 on GA media (moderate)

subfinder-2.7.0-2.1 on GA media Announcement ID: openSUSE-SU-2025:15004-1 Rating: moderate Cross-References: CVE-2024-0406 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the subfinder-2.7.0-2...

PT-2025-17134 · Expresstechsoftware · Memberpress Discord Addon

Name of the Vulnerable Software and Affected Versions: expresstechsoftware MemberPress Discord Addon versions 1.1.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS...

Oracle Linux 7 : libreoffice (ELSA-2025-3390)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-3390 advisory. 5.3.6.1-26.0.3 - Fix CVE-2025-1080, do not process macros in exotic uri schemes Orabug: 37770225 Tenable has extracted the preceding description block directly...

PT-2025-17117 · WordPress · Wp Easy Poll

Name of the Vulnerable Software and Affected Versions: WP Easy Poll versions 2.2.9 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS in WP Easy Poll. Recommendations: For ...