CVE-2025-13326 Mattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App Store

Mattermost Desktop App versions 6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attacker to inherit TCC permissions via copying the binary to a tmp folder...

CVE-2025-13326

CVE-2025-13326 affects Mattermost Desktop App on macOS versions prior to 6.0.0, failing to enable the Hardened Runtime in Mac App Store builds. This allows an attacker to inherit TCC permissions by copying the binary to a temporary folder. Affected component is the Mattermost Desktop App binary; ...

WordPress ModelTheme Addons for WPBakery and Elementor plugin < 1.5.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin ModelTheme Addons for WPBakery and Elementor versions 1.5.6...

AZL-72736 CVE-2025-68156 affecting package keda for versions less than 2.14.1-9

Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including flatten, min, max, mean, and median, perform recursive traversal over user-provided data structures without enforcing a maximum recursion depth. If the evaluation...

AZL-72634 CVE-2025-68303 affecting package kernel for versions less than 6.6.119.3-1

In the Linux kernel, the following vulnerability has been resolved: platform/x86: intel: punitipc: fix memory corruption This passes the address of the pointer "&punitipcdev" when the intent was to pass the pointer itself "punitipcdev" without the ampersand. This means that the:...

CVE-2025-11230 affecting package haproxy for versions less than 2.4.24-2

CVE-2025-11230 affecting package haproxy for versions less than 2.4.24-2. A patched version of the package is available...

CVE-2025-31160 affecting package atop for versions less than 2.6.0-10

CVE-2025-31160 affecting package atop for versions less than 2.6.0-10. A patched version of the package is available...

CVE-2025-8114 affecting package libssh for versions less than 0.10.6-5

CVE-2025-8114 affecting package libssh for versions less than 0.10.6-5. A patched version of the package is available...

CVE-2025-12817 affecting package postgresql for versions less than 14.20-1

CVE-2025-12817 affecting package postgresql for versions less than 14.20-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-11411 affecting package unbound for versions less than 1.19.1-4

CVE-2025-11411 affecting package unbound for versions less than 1.19.1-4. A patched version of the package is available...

CVE-2025-8277 affecting package libssh for versions less than 0.10.6-5

CVE-2025-8277 affecting package libssh for versions less than 0.10.6-5. A patched version of the package is available...

CVE-2025-58183 affecting package containerized-data-importer for versions less than 1.55.0-26

CVE-2025-58183 affecting package containerized-data-importer for versions less than 1.55.0-26. A patched version of the package is available...

CVE-2021-32256 affecting package gcc for versions less than 11.2.0-9

CVE-2021-32256 affecting package gcc for versions less than 11.2.0-9. A patched version of the package is available...

CVE-2025-8961 affecting package libtiff for versions less than 4.6.0-11

CVE-2025-8961 affecting package libtiff for versions less than 4.6.0-11. A patched version of the package is available...

CVE-2025-5918 affecting package cmake for versions less than 3.21.4-20

CVE-2025-5918 affecting package cmake for versions less than 3.21.4-20. A patched version of the package is available...

AZL-72466 CVE-2025-68229 affecting package kernel for versions less than 6.6.119.3-1

In the Linux kernel, the following vulnerability has been resolved: scsi: target: tcmloop: Fix segfault in tcmlooptpgaddressshow If the allocation of tlhba-sh fails in tcmloopdriverprobe and we attempt to dereference it in tcmlooptpgaddressshow we will get a segfault, see below for an example. So...

CVE-2025-68054 WordPress CountDown With Image or Video Background plugin <= 1.5 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in LambertGroup CountDown With Image or Video Background countdownwithbackground allows Blind SQL Injection.This issue affects CountDown With Image or Video Background: from n/a through = 1.5...

HPE OneView unauthenticated RCE

This module exploits an unauthenticated RCE vulnerability, CVE-2025-37164, against Hewlett Packard Enterprise HPE OneView. All versions below 11.00 are vulnerable so long as the vendor supplied hotfix has not been applied, however some VM product versions do not enable the vulnerable "ID Pools"...

EUVD-2025-203400

In grav 1.7.49.5, a SSRF Server-Side Request Forgery vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered...

CVE-2025-66844

In grav 1.7.49.5, a SSRF Server-Side Request Forgery vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered...