SUSE CVE-2025-7195

Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, usersetup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used...

CVE-2025-54800

Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-par...

CVE-2025-54800 Hydra persistent XSS in build metrics

Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-par...

CVE-2025-54800 Hydra persistent XSS in build metrics

Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-par...

CVE-2025-54800 Hydra persistent XSS in build metrics

Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-par...

CVE-2025-54800

Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-par...

CVE-2025-54800

CVE-2025-54800 describes a persistent XSS in Hydra (Nix-based CI) where a malicious package could inject arbitrary JavaScript into Hydra’s database, which then gets evaluated in a client’s browser when visiting the build page. The issue is stated as fixed by commit dea1e16; workarounds include no...

SUSE-SU-2025:02770-1 Security update for tiff

This update for tiff fixes the following issues: - Updated TIFFMergeFieldInfo with readcount=writecount=0 for FIELDIGNORE bsc1243503 - CVE-2025-8176: Fixed heap use-after-free in tools/tiffmedian.c bsc1247108 - CVE-2025-8177: Fixed possible buffer overflow in tools/thumbnail.c:setrow when...

Security update for go1.23

This update for go1.23 fixes the following issues: Update to go1.23.12: CVE-2025-47906: Fixed LookPath returning unexpected paths bsc1247719 CVE-2025-47907: Fixed incorrect results returned from Rows.Scan bsc1247720 go74415 runtime: use-after-free of allpSnapshot in findRunnable go74693 runtime:...

CVE-2025-8799

A vulnerability was identified in Open5GS up to 2.7.5. Affected by this vulnerability is the function amfnpcfampolicycontrolbuildcreate/amfnsmfpdusessionbuildcreatesmcontext of the file src/amf/npcf-build.c of the component AMF. The manipulation leads to denial of service. The attack can be...

KB5063814 - Description of the security update for SQL Server 2022 CU20: August 12, 2025

None None...

August 12, 2025—KB5063878 (OS Build 26100.4946) for Windows

None None...

KB5063758 - Description of the security update for SQL Server 2019 GDR: August 12, 2025

None None...

KB5063757 - Description of the security update for SQL Server 2019 CU32: August 12, 2025

None None...

Description of the security update for SharePoint Server Subscription Edition: August 12, 2025 (KB5002773)

None None...

Description of the security update for Office Online Server: August 12, 2025 (KB5002752)

None None...

August 12, 2025—Hotpatch KB5063812 (OS Build 20348.3989)

None None...

CVE-2025-54800: Improper Neutralization of Input During Web Page Generation

Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-par...

BIT-LIBPHP-2020-7063 Files added to tar with Phar::buildFromIterator have all-access permissions

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator function, the files are added with default permissions 0666, or all access even if the original files on the filesystem were with more restrictive permissions...

CVE-2025-8799 Open5GS AMF npcf-build.c amf_nsmf_pdusession_build_create_sm_context denial of service

A vulnerability was identified in Open5GS up to 2.7.5. Affected by this vulnerability is the function amfnpcfampolicycontrolbuildcreate/amfnsmfpdusessionbuildcreatesmcontext of the file src/amf/npcf-build.c of the component AMF. The manipulation leads to denial of service. The attack can be...