CVE-2025-58189

The Go programming language (affected in various Linux distributions like Rocky Linux and AlmaLinux ) is vulnerable to a flaw where a failed Conn.Handshake during ALPN negotiation produces an error containing unescaped, attacker-controlled information (the ALPN protocols sent by the client). This...

CVE-2025-58189 ALPN negotiation error contains attacker controlled information in crypto/tls

When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information the ALPN protocols sent by the client which is not escaped...

CVE-2025-58189

When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information the ALPN protocols sent by the client which is not escaped...

layer-client (0.3.5), sapsan (>=0.1.1, <=0.2.7) potentially affected by CVE-2025-11201 via mlflow (1.11.0)

mlflow PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - layer-client 0.3.5 - sapsan =0.1.1, =0.2.7 Source cves: CVE-2025-11201 Source advisory: OSV:GHSA-5CVJ-7RG6-JGGJ...

layer-client (0.3.5), sapsan (>=0.1.1, <=0.2.7) potentially affected by CVE-2025-11200 via mlflow (1.11.0)

mlflow PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - layer-client 0.3.5 - sapsan =0.1.1, =0.2.7 Source cves: CVE-2025-11200 Source advisory: OSV:GHSA-6XJ8-RRQX-R4CV...

backwardcompatibilityml (>=1.4.0, <=1.4.2), layer-client (>=0.3.7b1, <=0.3.9) potentially affected by CVE-2025-11201 via mlflow (1.12.1)

mlflow PYPI version 1.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - backwardcompatibilityml =1.4.0, =0.3.7b1, =0.3.9 Source cves: CVE-2025-11201 Source advisory: OSV:GHSA-5CVJ-7RG6-JGGJ...

layer-client (0.3.6), odahu-flow-mlflow-runner (1.4.0rc1) potentially affected by CVE-2025-11200 via mlflow (1.12.0)

mlflow PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - layer-client 0.3.6 - odahu-flow-mlflow-runner 1.4.0rc1 Source cves: CVE-2025-11200 Source advisory: OSV:GHSA-6XJ8-RRQX-R4CV...

layer-client (0.3.6), odahu-flow-mlflow-runner (1.4.0rc1) potentially affected by CVE-2025-11201 via mlflow (1.12.0)

mlflow PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - layer-client 0.3.6 - odahu-flow-mlflow-runner 1.4.0rc1 Source cves: CVE-2025-11201 Source advisory: OSV:GHSA-5CVJ-7RG6-JGGJ...

CVE-2025-1549

CVE-2025-1549 affects the WatchGuard Mobile VPN with SSL client for Windows. It describes a local privilege escalation where a local user can execute arbitrary commands with elevated privileges. The issue is stated as an additional unmitigated attack path for CVE-2024-4944. The vulnerability is r...

EUVD-2025-36679

Non-Compliant TLS Configuration.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...

Rogue WordPress Plugin Conceals Multi-Tiered Credit Card Skimmers in Fake PNG Files

The Wordfence Threat Intelligence Team recently discovered a sophisticated malware campaign targeting WordPress e-commerce sites, specifically those using the WooCommerce plugin. This malware exhibits advanced features including custom encryption methods, fake images used to conceal malicious...

Moderate: Red Hat Security Advisory: kernel-rt security update

An update for kernel-rt is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

GHSA-MQ84-HJQX-CWF2 Keras is vulnerable to arbitrary local file loading and Server-Side Request Forgery

The Keras.Model.loadmodel method, including when executed with the intended security mitigation safemode=True, is vulnerable to arbitrary local file loading and Server-Side Request Forgery SSRF. This vulnerability stems from the way the StringLookup layer is handled during model loading from a...

bunnieddpg (0.1.0), pdftotree (>=0.3.0, <=0.4.1) +2 more potentially affected by CVE-2025-12058 via keras (2.0.8)

keras PYPI version 2.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - bunnieddpg 0.1.0 - pdftotree =0.3.0, =0.1.1, =0.3.4 - yoctol-keras-layer-zoo 0.7.0 Source cves: CVE-2025-12058 Source advisory: OSV:GHSA-MQ84-HJQX-CWF...

EUVD-2025-36634

Keras is vulnerable to arbitrary local file loading and Server-Side Request Forgery...

CVE-2025-12058

The Keras.Model.loadmodel method, including when executed with the intended security mitigation safemode=True, is vulnerable to arbitrary local file loading and Server-Side Request Forgery SSRF. This vulnerability stems from the way the StringLookup layer is handled during model loading from a...

kernel: tls: fix handling of zero-length records on the rx_list

In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rxlist Each recvmsg call must process either - only contiguous DATA records any number of them - one non-DATA record If the next record has different type than what has already been...

kernel: tls: fix handling of zero-length records on the rx_list

In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rxlist Each recvmsg call must process either - only contiguous DATA records any number of them - one non-DATA record If the next record has different type than what has already been...

Moderate: Red Hat Security Advisory: kernel-rt security update

An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

WatchGuard Mobile VPN with SSL client has security vulnerabilities

WatchGuard Mobile VPN with SSL client is a remote access software from WatchGuard USA. A security vulnerability exists in WatchGuard Mobile VPN with SSL client that originates from an arbitrary command that can be executed by a local user, which may result in elevated privileges...