PT-2025-21487 · WordPress · Profilepro

Name of the Vulnerable Software and Affected Versions: ProfilePro WordPress plugin versions 1.3 and earlier Description: The issue concerns a lack of proper sanitization and escaping of certain parameters, combined with inadequate access controls. This could potentially allow users with a role as...

PT-2025-21902 · Crates.Io · Macroquad

Several soundness issues have been reported. Resolving them doesn't seem to be considered a priority. In particular, unprincipled use of mutable statics is pervasive throughout the library, making it possible to cause use-after-free in safe code. Currently, no fixed version is available...

PT-2025-21546 · WordPress · Cyan Backup

Name of the Vulnerable Software and Affected Versions: CYAN Backup WordPress plugin versions prior to 2.5.3 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, fo...

FreeBSD : libxslt -- multiple vulnerabilities (a96cd659-303e-11f0-94b5-54ee755069b5)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the a96cd659-303e-11f0-94b5-54ee755069b5 advisory. xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusio...

RHEL 8 : thunderbird (RHSA-2025:7689)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:7689 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Privilege escalation in Firefox Updater...

OPENSUSE-SU-2025:15090-1 libvmtools-devel-12.5.2-1.1 on GA media

These are all security issues fixed in the libvmtools-devel-12.5.2-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15089-1 iputils-20240905-3.1 on GA media

These are all security issues fixed in the iputils-20240905-3.1 package on the GA media of openSUSE Tumbleweed...

PT-2025-21492 · WordPress · Mapfig Studio Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The MapFig Studio WordPress plugin versions 0.2.1 and earlier Description: The issue concerns a lack of CSRF check in some areas of the plugin, along with missing sanitization and escaping. This could allow attackers to make logged-in admins...

PT-2025-21325 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.5.x through 10.5.2 Mattermost versions 9.11.x through 9.11.11 Description: The issue is related to improper verification of a user's permissions when accessing groups. This allows an attacker to view group information v...

SUSE SLED15: libopenssl-3-devel / libopenssl-3-devel-32bit / etc (SUSE-SU-2025:1550-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1550-1 advisory. Security: - CVE-2025-27587: Timing side channel vulnerability in the P-384 implementation when used with...

Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens

In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a build ID Token that impersonates a...

Google to pay $1.38 billion over privacy violations

The state of Texas reached a mammoth financial agreement with Google last week, securing $1.375 billion in payments to settle two three year-old lawsuits. The Office of Texas Attorney General Ken Paxton originally filed the first lawsuit against Google in January 2022, complaining that the tech...

DRUPAL-CONTRIB-2025-057

The Advanced File Destination module enhances file upload management in Drupal by allowing users to choose and create custom directories during file uploads. The module has multiple vulnerabilities that were reported through the Drupal Security Team's coordinated vulnerability process. The projec...

SUSE-SU-2025:1551-1 Security update for go1.24

This update for go1.24 fixes the following issues: Update to go1.24.3 bsc1236217: Security fixes: - CVE-2025-22873: Fixed os.Root permits access to parent directory bsc1242715 Changelog: go73556 go73555 security: fix CVE-2025-22873 os: Root permits access to parent directory go73082 os: Root.Open...

Security Bulletin: Multiple Vulnerabilities in IBM Event Streams

Summary Multiple vulnerabilities were addressed in IBM Event Streams version 11.7.0. Vulnerability Details CVEID:CVE-2024-52798 DESCRIPTION: path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cau...

Important: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.4 Telecommunications Update Service. Red Hat Product Security has rated this update as...

NETGEAR JWNR2000v2 sub_435E04 Function Command Injection Vulnerability

The NETGEAR JWNR2000v2 is a wireless router from NETGEAR. The NETGEAR JWNR2000v2 suffers from a command injection vulnerability that stems from the sub435E04 function parameter host failing to correctly filter constructor command special characters, commands, and so on. No details of the...

ROS-20250514-01

A vulnerability in the iiosimpledummytriggerh function of driver drivers/iio/dummy/iiosimpledummybuffer.c of the Linux kernel's IIO stub driver support is related to the use of an uninitialized resource. an uninitialized resource. Exploitation of the vulnerability could allow an attacker to gain...

Alibaba Cloud Linux 3 : 0256: lldpd (ALINUX3-SA-2024:0256)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0256 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2020-27827: A flaw was found in multip...

Alibaba Cloud Linux 3 : 0161: php:7.4 (ALINUX3-SA-2022:0161)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0161 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2020-28948: ArchiveTar through 1.4.10...