CVE-2025-2867

CVE-2025-2867 affects GitLab Duo with Amazon Q. Affected are GitLab releases: 17.8 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. The issue could allow a crafted input to manipulate AI-assisted development features, potentially exposing sensitive project data to unauthorized users. ...

USN-7376-1 mariadb vulnerability

A security issue was discovered in MariaDB and this update includes a new upstream MariaDB version to fix the issue. In addition to security fixes, the updated packages contain bug and regression fixes, new features, and possibly incompatible changes...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stmmac does not enable all security features by default...

CVE-2025-0845 DesignThemes Core Features <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The DesignThemes Core Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2025-0845 DesignThemes Core Features <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The DesignThemes Core Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2025-0845

CVE-2025-0845 : DesignThemes Core Features (WordPress) allows Stored XSS via shortcode attributes due to insufficient input sanitization and output escaping. Affected versions are “up to and including 4.8.” Exploitation requires authenticated access at contributor+ level, enabling an attacker to ...

org.opendaylight.groupbasedpolicy:features-groupbasedpolicy (=0.7.4), org.opendaylight.groupbasedpolicy:odl-groupbasedpolicy-neutron-and-ofoverlay (>=0.5.0-Carbon <=0.7.4) +18 more potentially affected by CVE-2025-29313 via org.opendaylight.sfc:sfc-openflow-renderer (>=0.10.0 <=0.9.3)

org.opendaylight.sfc:sfc-openflow-renderer MAVEN version =0.10.0, =0.5.0-Carbon, =0.5.0-Carbon, =0.5.0-Carbon, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.6.0, =0.6.0, =0.4.0-Carbon, =0.5.0, =0.4.0-Carbon, =0.5.0, =0.5.2 and more Source cves: CVE-2025-29313 Source advisory:...

WordPress DesignThemes Core Features plugin <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by István Márton in WordPress Plugin DesignThemes Core Features versions = 4.8...

Dell NetWorker Open Redirect Vulnerability

Dell NetWorker is an application from Dell USA Inc. Provides forum discussion features for Dell Inc. Dell NetWorker suffers from an open redirection vulnerability that stems from the system not handling target jumps appropriately, no details of the vulnerability are available at this time...

youki 安全漏洞

youki is a youki open source implementation of the OCI runtime specification in Rust. A security vulnerability exists in versions of youki prior to 0.5.3 that stems from a tenant builder accepting a list of features to be added to the tenant container specification during the creation of a tenant...

How to Improve Okta Security in Four Steps

While Okta provides robust native security features, configuration drift, identity sprawl, and misconfigurations can provide opportunities for attackers to find their way in. This article covers four key ways to proactively secure Okta as part of your identity security efforts. Okta serves as the...

Amazon disables privacy option, will send your Echo voice recordings to the cloud

Amazon has announced its Echo devices will no longer have the option to store and process requests on the device itself, meaning your voice recordings will now be sent to the cloud for processing. In an email sent to customers, Amazon explained that the feature "Do Not Send Voice Recordings" will...

Advisory ROSA-SA-2025-2776

Software: libssh 0.9.6 OS: ROSA Virtualization 2.1 packageevrstring: libssh-0.9.6-14.rv3 CVE-ID: CVE-2023-48795 BDU-ID: 2023-08853 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the SSH protocol implementation is related to the ability to adjust packet sequence numbers during the connection...

RLSA-2024:9457 Moderate: python3.12-urllib3 security update

urllib3 is a powerful, user-friendly HTTP client for Python. urllib3 brings many critical features that are missing from the Python standard libraries: • Thread safety. • Connection pooling. • Client-side SSL/TLS verification. • File uploads with multipart encoding. • Helpers for retrying request...

[SECURITY] Fedora 40 Update: vim-9.1.1202-1.fc40

VIM VIsual editor iMproved is an updated and improved version of the vi editor. Vi was the first real screen-based editor for UNIX, and is still very popular. VIM improves on vi by adding new features: multiple windows, multi-level undo, block highlighting and more...

[SECURITY] Fedora 41 Update: libxml2-2.12.10-1.fc41

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

Moderate: Red Hat Security Advisory: ACS 4.7 enhancement and security update

Updated images are now available for Red Hat Advanced Cluster Security for Kubernetes RHACS. The updated image includes new features and security and bug fixes. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base...

[SECURITY] Fedora 41 Update: kitty-0.40.0-2.fc41

Offloads rendering to the GPU for lower system load and buttery smooth scrolling. Uses threaded rendering to minimize input latency. - Supports all modern terminal features: graphics images, unicode, true-col or, OpenType ligatures, mouse protocol, focus tracking, bracketed paste and several new...

Apple macOS 安全漏洞

Apple macOS Sequoia is an operating system announced by Apple at the WWDC24 developer conference on June 10, 2024, with the official version launched in the fall of the same year, primarily for Mac devices, emphasizing cross-device collaboration and integration of AI functionality to significantl...

[SECURITY] Fedora 42 Update: gdcm-3.0.24-8.fc42

Grassroots DiCoM GDCM is a C++ library for DICOM medical files. It supports ACR-NEMA version 1 and 2 huffman compression is not supported, RAW, JPEG, JPEG 2000, JPEG-LS, RLE and deflated transfer syntax. It comes with a super fast scanner implementation to quickly scan hundreds of DICOM files. It...