SUSE SLED15: libQt5Bootstrap-devel-static / libQt5Bootstrap-devel-static-32bit / etc (SUSE-SU-2025:3723-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3723-1 advisory. Security issues fixed: - CVE-2025-5455: processing of malformed data in qDecodeDataUrl can trigg...

EUVD-2018-11048

Malware in sbrugna...

EUVD-2010-3754

Malware in sbrugna...

EUVD-2017-6514

Malware in sbrugna...

EUVD-2016-3029

Malware in sbrugna...

EUVD-2017-16809

Malware in sbrugna...

EUVD-2016-10689

Malware in sbrugna...

EUVD-2016-9899

Malware in sbrugna...

EUVD-2016-6202

Malware in sbrugna...

EUVD-2017-14570

Malware in sbrugna...

EUVD-2017-16226

Malware in sbrugna...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: qt5-qtbase (UTSA-2025-986101)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986101 advisory. An issue was found in the private API function qDecodeDataUrl in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the...

EUVD-2024-19626

Malicious code in bioql PyPI...

EUVD-2025-28611

Malicious code in bioql PyPI...

CVE-2025-58754

Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory...

CVE-2025-58754

CVE-2025-58754 affects Axios (Node.js) where, in versions prior to 0.30.2 and 1.12.0, processing a data: URL causes the Node http adapter to decode the entire payload into memory, bypassing maxContentLength/maxBodyLength, and return a synthetic 200 response. This can lead to unbounded memory allo...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.bowergithub.axios:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the data: URL handler. An attacker can trigger a denial of service by crafting a...

CVE-2025-58361

Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions contain an non-exhaustive URL scheme check that does not protect against XSS. User-controlled URLs pass through src/utils/validation.ts, but the check only strips javascript: a...

CLSA-2025-1756932817 nodejs: Fix of CVE-2024-22020

CVE-2024-22020: forbid data URLs in network imports to mitigate security flaw allowing bypass of network import restrictions...

SUSE-SU-2025:02968-1 Security update for libqt4

This update for libqt4 fixes the following issues: - CVE-2021-45930: Fixed out-of-bounds write leading to DoS bsc1196654 - CVE-2023-32573: Fixed missing initialization of QtSvg QSvgFont munitsPerEm bsc1211298 - CVE-2023-32763: Fixed buffer overflow on QTextLayout during rendering of an SVG file...