1255 matches found
TYPO3-EXT-SA-2025-002: Cross-Site Scripting in extension “Additional TCA” (additional_tca)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2025-002...
runc security update
An update is available for runc. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The runC tool is a lightweight, portable implementation of the Open Container...
CLSA-2025-1741624657 bind: Fix of CVE-2024-11187
CVE-2024-11187: fix Denial of Service via Additional Section Resource Exhaustion in BIND 9...
firefox: Unexpected GC during RegExp bailout processing
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was not expecting it...
CVE-2024-13906
The CVE-2024-13906 entry pertains to Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress (WordPress plugin) versions
CLSA-2025-1741216880 bind: Fix of CVE-2024-11187
CVE-2024-11187: fix Denial of Service via Additional Section Resource Exhaustion in BIND 9...
CLSA-2025-1741126041 bind: Fix of CVE-2024-11187
CVE-2024-11187: fix excessive resource usage by limiting additional section processing and adjusting resolver tests...
CVE-2025-1934
It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was not expecting it. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8...
Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-802)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-802 advisory. In the Linux kernel, the following vulnerability has been resolved: nullblk: fix null-ptr-dereference while configuring 'power' and 'submitqueues' CVE-2024-36478 In the Linux kernel, the...
OESA-2025-1215 bind security update
BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...
CVE-2022-49264 exec: Force single empty string when argv is empty
In the Linux kernel, the following vulnerability has been resolved: exec: Force single empty string when argv is empty Quoting1 Ariadne Conill: "In several other operating systems, it is a hard requirement that the second argument to execve2 be the name of a program, thus prohibiting a scenario...
Moodle allows reflected XSS via question bank filter
The question bank filter required additional sanitizing to prevent a reflected XSS risk...
CVE-2025-26529
Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk...
UBUNTU-CVE-2025-26532
Additional checks were required to ensure trusttext is applied when enabled to glossary entries being restored...
CVE-2025-26530 Reflected XSS via question bank filter
The question bank filter required additional sanitizing to prevent a reflected XSS risk...
CVE-2025-26529 Stored XSS risk in admin live log
Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk...
OESA-2025-1172 bind security update
BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...
bind: bind9: Many records in the additional section cause CPU exhaustion
A flaw was found in the bind package where a crafted DNS zone may generate numerous records in the 'Additional' section of the response. This flaw allows an attacker to send a large amount of such queries, which may lead either the authoritative server or an independent resolver to run into an...
