CVE-2025-59385

The CVE-2025-59385 issue is an authentication bypass by spoofing affecting QNAP QTS and QuTS hero OSes. The vulnerability could allow remote attackers to access restricted resources. Fixed in QTS 5.2.7.3297 (build 20251024) and QuTS hero h5.2.7.3297 (build 20251024) as well as h5.3.1.3292 (build ...

EUVD-2025-203490

An improper neutralization of argument delimiters in a command vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to alter execution logic. We have already fixed the vulnerability in the following versions: QTS...

CVE-2025-62848

CVE-2025-62848 is a NULL pointer dereference vulnerability reported affecting multiple QNAP platforms (QTS and QuTS hero). The issue allows remote attackers to trigger a denial-of-service via network access, as described in vendor notes. Affected versions have been patched in QTS 5.2.7.3297 build...

PT-2025-51618

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's ALSA subsystem, specifically within the HDMI codec driver code related to the nvhdmi-mcp driver. A copy-and-paste error swapped the build controls and...

Sensitive Information Exposure

Jenkins ByteGuard Build Actions Plugin is vulnerable to sensitive information exposure. The vulnerability is due to improper masking of API tokens on the job configuration form, which allows an attacker to observe and capture these tokens...

Cross-site Scripting (XSS)

Jenkins Applitools Eyes Plugin is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the plugin not escaping the Applitools URL on the build page, where attackers with Item/Configure permission can exploit it to inject malicious scripts...

Authorization Bypass

Jenkins global-build-stats Plugin is vulnerable to Authorization Bypass. The vulnerability is due to missing permission checks in REST API endpoints, where the plugin exposes graph-related APIs without validating the caller’s authorization, and allows attackers with Overall/Read permission to...

Cross Site Scripting

Jenkins Spring Config Plugin is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper escaping of build display names in the Spring Config view, allowing attackers who can modify build display names to inject malicious scripts that execute in other users' browsers...

Sensitive Information Exposure

Jenkins ByteGuard Build Actions Plugin is vulnerable to Sensitive Information Exposure. The vulnerability is due to storing API tokens in plaintext within job config.xml files, where the plugin does not encrypt or otherwise protect secret values, and allows attackers with Item/Extended Read...

PT-2026-4660

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the nvme-tcp subsystem, specifically in the nvmet tcp build pdu iovec function. This function can dereference null pointers without proper checks...

SUSE SLED15: postgresql16 / postgresql16-contrib / postgresql16-devel / etc (SUSE-SU-2025:4388-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4388-1 advisory. Upgraded to 16.11: - CVE-2025-12817: Fixed missing check for CREATE privileges on the schema in...

CVE-2025-66586

In AzeoTech DAQFactory release 20.7 Build 2555, an Access of Resource Using Incompatible Type vulnerability can be exploited to cause memory corruption while parsing specially crafted .ctl files. This could allow an attacker to execute code in the context of the current process...

CVE-2025-66590

In AzeoTech DAQFactory release 20.7 Build 2555, an Out-of-bounds Write vulnerability can be exploited by an attacker to cause the program to write data past the end of an allocated memory buffer. This can lead to arbitrary code execution or a system crash...

CVE-2025-66584

In AzeoTech DAQFactory release 20.7 Build 2555, a Stack-Based Buffer Overflow vulnerability can be exploited to cause memory corruption while parsing specially crafted .ctl files. This could allow an attacker to execute code in the context of the current process...

@c0va23/react-router-dev (7.8.3-alpha.2), @orange-js/vite (>=0.0.0-1ae0b37, <=0.0.0-fff5d2d) +9 more potentially affected by unknown CVE via @vitejs/plugin-rsc (>=0.4.11, <=0.5.2)

@vitejs/plugin-rsc NPM version =0.4.11, =0.0.0-1ae0b37, =0.0.0-experimental-14dc7c1, =0.0.0-pr-32412-sha-076721d1, =1.0.2, =0.0.1, =0.0.1-alpha.0, =1.0.0, =0.0.0-experimental-64e35ee-20250807, =0.24.0-alpha.0, =0.27.2 Source cves: unknown CVE Source advisory: OSV:GHSA-CPQF-F22C-R95X...

BIT-JENKINS-2025-67638

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

BIT-JENKINS-2025-67637

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

@c0va23/react-router-dev (7.8.3-alpha.2), @orange-js/vite (>=0.0.0-1ae0b37, <=0.0.0-fff5d2d) +9 more potentially affected by CVE-2025-55183 +2 more via @vitejs/plugin-rsc (>=0.4.11, <=0.5.2)

@vitejs/plugin-rsc NPM version =0.4.11, =0.0.0-1ae0b37, =0.0.0-experimental-14dc7c1, =0.0.0-pr-32412-sha-076721d1, =1.0.2, =0.0.1, =0.0.1-alpha.0, =1.0.0, =0.0.0-experimental-64e35ee-20250807, =0.24.0-alpha.0, =0.27.2 Source cves: CVE-2025-55183, CVE-2025-55184, CVE-2025-67779 Source advisory:...

SUSE SLED15: libecpg6 / libecpg6-32bit / libpq5 / libpq5-32bit / postgresql / etc (SUSE-SU-2025:4363-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4363-1 advisory. Changes in postgresql18: - Fix build with uring for post SLE15 code streams. Update to 18.1:...

SUSE SLES15: libecpg6 / libpq5 / libpq5-32bit / postgresql / postgresql-contrib / etc (SUSE-SU-2025:4364-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4364-1 advisory. Changes in postgresql18: - Fix build with uring for post SLE15 code streams. Update to 18.1:...