CVE-2025-26869: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Build allows Stored XSS.This issue affects Build: from n/a through 1.0.3...

@adhd/backlog (>=1.0.0, <=1.0.16), @adhd/dispatch-cli (>=0.1.6, <=0.1.8) +441 more potentially affected by CVE-2025-30208 via vite (>=5.0.0, <=5.4.14)

vite NPM version =5.0.0, =1.0.0, =0.1.6, =2.2.1, =0.0.1, =0.7.9, =4.23.1-prerelease.0, =17.1.0-next.0, =18.0.0-next.3, =1.0.25-beta.0, =0.0.1-alpha.0, =0.5.0, =0.5.5 - @avorati/strapi-plugin-preview 1.0.1 - @beaker-tools/typescript-toolkit 1.3.0 and more Source cves: CVE-2025-30208 Source advisor...

@aicblock/cli (>=1.0.0, <=1.0.1), @angular-devkit/build-angular (>=19.2.1, <=20.0.0-next.2) +34 more potentially affected by CVE-2025-30208 via vite (>=6.2.0, <=6.2.2)

vite NPM version =6.2.0, =1.0.0, =19.2.1, =19.2.1, =0.55.0, =1.0.0, =1.0.410, =5.0.0-alpha.40, =1.0.0-next.1, =3.0.0-BETA.0, =19.1.1-snapshot-1741264224607, =19.1.1-snapshot-1741264224607, =19.1.3 and more Source cves: CVE-2025-30208 Source advisory: OSV:GHSA-X574-M823-4X7W...

@angular-devkit/build-angular (>=19.2.0-next.2, <=19.2.0), @angular/build (>=19.2.0-next.2, <=19.2.0) +40 more potentially affected by CVE-2025-30208 via vite (>=6.1.0, <=6.1.1)

vite NPM version =6.1.0, =19.2.0-next.2, =19.2.0-next.2, =1.0.7, =2.12.0, =2.12.0, =11.24.0, =0.0.1739797164641, =1.0.0, =0.0.0-experimental-989cf02-20250217-d62ba1cb, =0.0.0-experimental-0580205-20250209-2be35102, =0.0.0-snapshot-08bd566ea55152626f488c12d32ebce7e35b812d,...

SUSE-SU-2025:20160-1 Security update for openssh

This update for openssh fixes the following issues: - CVE-2025-26465: Fixed MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client bsc1237040. - CVE-2025-26466: Fixed DoS attack against OpenSSH's client and server bsc1237041. Other bugfixes: - Fix ssh client segfault with...

Malware in patternfly-build

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

WordPress Build theme <= 1.0.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Theme Build versions = 1.0.3...

PT-2025-16750

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory allocation error in the Linux kernel's netfilter module has been resolved. The issue occurred because the ctx variable in nfqnl build packet message could be used before it was...

CVE-2024-54551

The issue was addressed with improved memory handling. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing web content may lead to a denial-of-service...

podman: buildah: Container breakout by using --jobs=2 and a race condition when building a malicious Containerfile

A vulnerability was found in podman build and buildah. This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the hos...

podman: Build Context Bind Mount

A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build context directory on the host, leaving the created files...

PT-2025-12353 · Luxion · Luxion Keyshot

Name of the Vulnerable Software and Affected Versions: Luxion KeyShot versions 4.10.171 and 13.0.0 Build 92 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required, as the target must visit a...

PT-2025-12354 · Luxion · Luxion Keyshot

Name of the Vulnerable Software and Affected Versions: Luxion KeyShot versions 2024 13.0.0 Build 92 and 4.10.171 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required, as the target must visit a...

Inure 信息泄露漏洞

Inure is an Android application manager by the individual developer Hamza Rizwan. An information disclosure vulnerability exists in versions prior to Inure build97, which stems from a misconfiguration of the AndroidManifest.xml file and could lead to task hijacking and disclosure of sensitive...

podman: buildah: Container breakout by using --jobs=2 and a race condition when building a malicious Containerfile

A vulnerability was found in podman build and buildah. This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the hos...

CVE-2025-30196

Jenkins AnchorChain Plugin 1.0 does not limit URL schemes for links it creates based on workspace content, allowing the javascript: scheme, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control the input file for the Anchor Chain post-build step...

PT-2025-11701

Name of the Vulnerable Software and Affected Versions Jenkins AnchorChain Plugin version 1.0 Description The issue allows attackers to exploit a stored cross-site scripting XSS vulnerability by controlling the input file for the Anchor Chain post-build step. This is due to the plugin not limiting...

CVE-2025-30196: Improper Neutralization of Input During Web Page Generation

Jenkins AnchorChain Plugin 1.0 does not limit URL schemes for links it creates based on workspace content, allowing the javascript: scheme, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control the input file for the Anchor Chain post-build step...

Stored XSS vulnerability in AnchorChain

AnchorChain 1.0 does not limit URL schemes for links it creates based on workspace content, allowing the javascript: scheme. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control the input file for the Anchor Chain post-build step. As of...

Security update for tpm2.0-tools, tpm2-0-tss

This update for tpm2.0-tools, tpm2-0-tss fixes the following issues: tpm2-0-tss: Update to version 4.1: + Security - CVE-2024-29040: arbitrary quote data may go undetected by FapiVerifyQuote bsc1223690 Fixed fapi: Fix length check on FAPI auth callbacks mu: Correct error message for errors...