CVE-2025-42890: Use of Hard-coded Credentials

SQL Anywhere Monitor Non-GUI baked credentials into the code,exposing the resources or functionality to unintended users and providing attackers with the possibility of arbitrary code execution.This could cause high impact on confidentiality integrity and availability of the system...

PT-2025-46413

Name of the Vulnerable Software and Affected Versions Intel UEFI reference platforms affected versions not specified Description The kernel on some Intel UEFI reference platforms contains debug code that may allow a denial of service and escalation of privilege. A system software adversary with...

kernel: wifi: cfg80211: fix use-after-free in cmp_bss()

A use after free vulnerbility exists in the linux kernel wifi module in the cmpbss function,an attacker could create a crafted payload to trigger, leading to damage availability and integrity of the system...

OPENSUSE-SU-2025:15724-1 trivy-0.67.2-1.1 on GA media

These are all security issues fixed in the trivy-0.67.2-1.1 package on the GA media of openSUSE Tumbleweed...

NetBird VPN Default Login Credentials

The vulnerability of the VPN client NetBird is related to the use of default login credentials. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Qualcomm Embedded Software Array Indexing

The vulnerability of microprogramming software in embedded Qualcomm chips is related to unverified array indexing. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information...

Audio Component Qualcomm Data Compromise

The vulnerability of the Audio microprogramming component in Qualcomm’s embedded chips is related to unvalidated array indexing. Exploiting this vulnerability could allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information...

Windows Compute system components Data Compromise

The vulnerability of the Windows Compute microprogramming system components in Qualcomm’s embedded chips relates to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of the protected...

OPENSUSE-SU-2025:15723-1 regclient-0.10.0-1.1 on GA media

These are all security issues fixed in the regclient-0.10.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15721-1 incus-6.17-2.1 on GA media

These are all security issues fixed in the incus-6.17-2.1 package on the GA media of openSUSE Tumbleweed...

xen-4.20.1_08-1.1 on GA media (moderate)

xen-4.20.108-1.1 on GA media Announcement ID: openSUSE-SU-2025:15719-1 Rating: moderate Cross-References: CVE-2025-58149 CVSS scores: CVE-2025-58149 SUSE : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2025-58149 SUSE : 4.3 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N...

OPENSUSE-SU-2025:15720-1 chromedriver-142.0.7444.134-1.1 on GA media

These are all security issues fixed in the chromedriver-142.0.7444.134-1.1 package on the GA media of openSUSE Tumbleweed...

tomcat11-11.0.13-1.1 on GA media (moderate)

tomcat11-11.0.13-1.1 on GA media Announcement ID: openSUSE-SU-2025:15718-1 Rating: moderate Cross-References: CVE-2025-55752 CVE-2025-55754 CVE-2025-61795 CVSS scores: CVE-2025-55752 SUSE : 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2025-55752 SUSE : 7.7...

CVE-2025-64434

KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, due to the peer verification logic in virt-handler via verifyPeerCert, an attacker who compromises a virt-handler instance, could exploit these shared credentials to impersonate virt-api and execute privileg...

CVE-2025-64481

Datasette is an open source multi-tool for exploring and publishing data. In versions 0.65.1 and below and 1.0a0 through 1.0a19, deployed instances of Datasette include an open redirect vulnerability. Hits to the path //example.com/foo/bar/ the trailing slash is required will redirect the user to...

CVE-2025-63783

A Broken Object Level Authorization BOLA vulnerability was discovered in the tRPC project mutation APIs update, delete, add/remove tag of the Onlook web application 0.2.32. The vulnerability exists because the API fails to verify the ownership or membership of the currently authenticated user for...

OPENSUSE-SU-2025:15715-1 squid-7.3-1.1 on GA media

These are all security issues fixed in the squid-7.3-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15710-1 govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20251105T184115-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2025-63783: Improper Input Validation

A Broken Object Level Authorization BOLA vulnerability was discovered in the tRPC project mutation APIs update, delete, add/remove tag of the Onlook web application 0.2.32. The vulnerability exists because the API fails to verify the ownership or membership of the currently authenticated user for...

Onlook security vulnerabilities

Onlook is a source code visual editing tool from the Onlook open source. A security vulnerability exists in Onlook version 0.2.32, which stems from the API not validating the ownership or membership of the current authenticated user for the requested item ID, potentially resulting in compromised...