CVE-2025-64328

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the...

Red Hat Single Sign-On 输入验证错误漏洞

Red Hat Single Sign-On is an authentication and access control system from Red Hat USA. The tool is responsible for authentication and access control functions for systems that support most authentication protocols Oauth, OpenId Connect, etc., and can easily integrate with most products such as...

Open Redirection

@lobehub/chat is vulnerable to Open Redirection. The vulnerability is due to improper validation of X-Forwarded- and Host headers in the OIDC redirect handling logic, which allows an attacker to inject a malicious host and redirect users to arbitrary domains...

Zero Trust Security Model Implementation in Microservices Architectures Using Identity Federation

The microservice bombshells that have been linked with the microservice expansion have altered the application architectures, offered agility and scalability in terms of complexity in security trade-offs. Feeble legacy-based perimeter-based policies are unable to offer safeguard to distributed...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990431)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990431 advisory. In the Linux kernel, the following vulnerability has been resolved: vsock: remove vsock from connected table when connect is interrupted by a signal vsockconnect...

DELL Secure Connect Gateway Policy Manager Cross-Site Scripting Vulnerability

DELL Secure Connect Gateway Policy Manager is a Secure Connect Gateway management tool from Dell that is used to configure and manage security policies for SecureConnectGateway SCG devices. A cross-site scripting vulnerability exists in DELL Secure Connect Gateway Policy Manager that originates...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990056)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990056 advisory. In the Linux kernel, the following vulnerability has been resolved: vsock: remove vsock from connected table when connect is interrupted by a signal vsockconnect...

Dell Secure Connect Gateway Relative Path Traversal Vulnerability

Dell Secure Connect Gateway is an enterprise-grade secure connectivity gateway appliance from Dell that is used to monitor hardware status, automate the creation of support requests, and securely communicate to safeguard device connectivity to Dell backend services. A relative path traversal...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989338)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989338 advisory. In the Linux kernel, the following vulnerability has been resolved: Bluetooth: use memset avoid memory leaks Use memset to initialize structs to prevent memory leaks...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990028)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990028 advisory. In the Linux kernel, the following vulnerability has been resolved: nvmet: fix a possible leak when destroy a ctrl during qp establishment In nvmetsqdestroy we captu...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988975)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988975 advisory. In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix dangling scoconn and use-after-free in scosocktimeout Connecting the same socket...

Information Disclosure

OpenBao is vulnerable to an Information Disclosure Vulnerability. The vulnerability is due to a regression in audit log redaction, where raw HTTP request bodies for ACME and OIDC issuer endpoints are not properly HMAC-redacted, allowing short-lived ACME verification codes, authentication response...

CVE-2025-47370 Reachable Assertion in BT Controller

Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID length in cfg80211connectresult If the ssid-datalen is greater than IEEE80211MAXSSIDLEN 32, it could lead to memory corruption. Therefore, bounds checking should be added...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: userial: Fixed race condition in TTY wakeup A race condition occurs when gsstartio calls either gsstartrx or gsstarttx. These functions briefly release the portlock of usbepqueue. This allows gsclose and...

Astra Linux – Vulnerability in curl

curl will incorrectly reuse an existing HTTP proxy connection when making a CONNECT request to a server, even if the new request uses different credentials for the HTTP proxy. The correct behavior is to create or use a separate connection...

CVE-2025-46363

Dell Secure Connect Gateway SCG 5.0 Application and Appliance versions 5.26.00.00 - 5.30.00.00, contain a Relative Path Traversal vulnerability in the SCG exposed for an internal collection download REST API if this REST API is enabled by Admin user from UI. A low privileged attacker with remote...

CVE-2025-36592

Dell Secure Connect Gateway SCG Policy Manager, versions 5.20. 5.22, 5.24, 5.26, 5.28, contains an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading...

Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates

Summary IBM App Connect Enterprise Certified Container ACEcc is built on the Red Hat Universal Base Images. ACEcc operator versions 12.0.17 LTS and 12.17.0 contain fixes to the listed CVEs found in the base images. This bulletin provides patch information to address the reported vulnerabilities...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to loss of confidentiality [CVE-2025-59343]

Summary Node.js module tar-fs is used by IBM App Connect Enterprise Certified Container for processing tar files and streams. IBM App Connect Enterprise Certified Container operands are vulnerable to loss of confidentiality. This bulletin provides patch information to address the reported...