CVE-2025-25197

Silverstripe Elemental extends a page type to swap the content area for a list of manageable elements to compose a page out of rather than a single text field. An elemental block can include an XSS payload, which can be executed when viewing the "Content blocks in use" report. The vulnerability i...

Updated gnupg2 packages fix security vulnerability

In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS". CVE-2025-30258...

python311-PyJWT-2.10.1-2.1 on GA media (moderate)

python311-PyJWT-2.10.1-2.1 on GA media Announcement ID: openSUSE-SU-2025:14987-1 Rating: moderate Cross-References: CVE-2022-29217 CVSS scores: CVE-2022-29217 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can...

CVE-2025-32378

Shopware is an open source e-commerce software platform. Prior to 6.6.10.3 or 6.5.8.17, the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation. Default settings are Newsletter: Double Opt-in set to active, Newsletter: Double opt-in for registere...

CVE-2023-41076

An app may be able to elevate privileges. This issue is fixed in macOS 14. This issue was addressed by removing the vulnerable code...

OESA-2025-1395 mariadb security update

MariaDB turns data into structured information in a wide array of applications, ranging from banking to websites. It is an enhanced, drop-in replacement for MySQL. MariaDB is used because it is fast, scalable and robust, with a rich ecosystem of storage engines, plugins and many other tools make ...

SUSE-SU-2025:1199-1 Security update for fontforge

This update for fontforge fixes the following issues: - CVE-2017-17521: Fixed command injection in help function uiutil.c bsc1073014...

Vulnerability fixed on May 13, 2025

...

PT-2025-16027 · Arista · Arista Eos

Name of the Vulnerable Software and Affected Versions: Arista EOS affected versions not specified Description: The issue exposes cleartext data, risking the interception of sensitive information. Recommendations: At the moment, there is no information about a newer version that contains a fix for...

Security Bulletin: IBM QRadar Wincollect agent is vulnerable to denial of service ( CVE-2024-51461)

Summary IBM QRadar Wincollect agent is vulnerable to denial of service. The vulnerability have been addressed in the latest update. Vulnerability Details CVEID:CVE-2024-51461 DESCRIPTION: IBM QRadar WinCollect Agent could allow a remote attacker to cause a denial of service by interrupting an HTT...

CVE-2025-32020

The crud-query-parser library parses query parameters from HTTP requests and converts them to database queries. Improper neutralization of the order/sort parameter in the TypeORM adapter, which allows SQL injection. You are impacted by this vulnerability if you are using the TypeORM adapter,...

CVE-2025-25197 Silverstripe Elemental enables XSS attacks in elemental "Content blocks in use" reports

Silverstripe Elemental extends a page type to swap the content area for a list of manageable elements to compose a page out of rather than a single text field. An elemental block can include an XSS payload, which can be executed when viewing the "Content blocks in use" report. The vulnerability i...

WordPress MSRP (RRP) Pricing for WooCommerce Plugin <= 1.8.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin MSRP RRP Pricing for WooCommerce versions = 1.8.1...

PT-2025-15965 · Hewlett Packard · Hpe Nonstop Osm Service Connection Suite

Name of the Vulnerable Software and Affected Versions: HPE NonStop OSM Service Connection Suite affected versions not specified Description: A potential security issue in HPE NonStop OSM Service Connection Suite could be exploited to allow a local Denial of Service. Recommendations: At the moment...

govulncheck-vulndb-0.0.20250408T210408-1.1 on GA media (moderate)

govulncheck-vulndb-0.0.20250408T210408-1.1 on GA media Announcement ID: openSUSE-SU-2025:14978-1 Rating: moderate Cross-References: CVE-2025-22871 CVSS scores: CVE-2025-22871 SUSE : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2025-22871 SUSE : 9.1...

Vulnerability fixed in Adobe Photoshop

Adobe has fixed a vulnerability in Photoshop Desktop Specifically for versions 25.12.1, 26.4.1 and earlier. The vulnerability is in the way Photoshop Desktop handles files. A malicious party can exploit this vulnerability by creating a malicious file that, when opened by the user, can lead to...

Vulnerability fixed in FortiSwitch

Fortinet has fixed a vulnerability in the FortiSwitch GUI. The vulnerability with reference CVE-2024-48887, is located in the FortiSwitch GUI, which allows a remote, unauthenticated malicious person to change admin passwords via specially crafted requests. This security issue can lead to...

PT-2025-15795 · Unknown · Debounce Email Validator

Name of the Vulnerable Software and Affected Versions: DeBounce Email Validator versions n/a through 5.7.1 Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject...

Debian dla-4122 : libbssolv-perl - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4122 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4122-1 [email protected] https://www.debian.org/lts/security/...

PT-2025-15825 · Unknown · Mapsvg Lite

Name of the Vulnerable Software and Affected Versions: MapSVG Lite versions through 8.5.32 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an attacker could potentiall...