CVE-2025-53015

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0, infinite lines occur when writing during a specific XMP file conversion command. Version 7.1.2-0 fixes the issue. Mitigation Mitigation for this issue is either not availab...

CVE-2025-53689

An XML external entity flaw was found in Apache Jackrabbit. This issue occurs when using an unsecured document builder to load privileges and is vulnerable to an attack where a malicious user can inject harmful code. Mitigation Mitigation for this issue is either not available or the currently...

Security Bulletin: IBM Jazz for Service Management is vulnerable to cross-site scripting via searchWord parameter.

Summary IBM Jazz for Service Management is vulnerable to cross-site scripting, allowing malicious scripts to be executed via the searchWord parameter on the static help page CVE-2024-52892. Vulnerability Details CVEID:CVE-2024-52892 DESCRIPTION: IBM Jazz for Service Management is vulnerable to...

CVE-2025-1220

A flaw was found in PHP. The fsockopen function and related functions fail to validate NULL characters within the provided hostname, potentially leading to unexpected behavior during parsing. This flaw allows a network attacker to supply a specially crafted hostname. This issue can result in a...

CVE-2025-7545

A flaw was found in binutils. The copysection function in binutils/objcopy.c is susceptible to a heap-based buffer overflow due to improper bounds checking during data copying. This flaw allows a local attacker to provide a specially crafted file. This manipulation can lead to a denial of service...

CVE-2025-7546

A flaw was found in gnu-binutils. The bfdelfsetgroupcontents function in bfd/elf.c contains an out-of-bounds write vulnerability triggered by manipulation of the ELF file contents. This flaw allows a local attacker to provide a crafted file. This manipulation can lead to memory corruption...

PT-2025-29499 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SemCms version 5.0 Description: SemCms version 5.0 contains a SQL injection vulnerability through the ID parameter at the SEMCMS Products.php endpoint. Recommendations: As a mitigation, sanitize or validate the ID parameter at the SEMCMS...

WordPress JetEngine <= 3.7.0 - Remote Code Execution (RCE) Vulnerability

Remote Code Execution RCE Vulnerability discovered by stealthcopter in WordPress Plugin JetEngine versions = 3.7.0...

PT-2025-30608 · Hackage · Cabal-Install

cabal-install dependency confusion For cabal-install 3.4.0.0 and where multiple repositories are configured, the resolver picks the highest available version across all repositories. Where a package is only defined in a private repository, this behaviour leads to a dependency confusionblog supply...

Demo: Secure Edge Server for Network Slicing and Resource Allocation in Open RAN

Next-Generation Radio Access Networks NGRAN aim to support diverse vertical applications with strict security, latency, and Service-Level Agreement SLA requirements. These demands introduce challenges in securing the infrastructure, allocating resources dynamically, and enabling real-time...

When Developer Aid Becomes Security Debt: a Systematic Analysis of Insecure Behaviors in LLM Coding Agents

LLM-based coding agents are rapidly being deployed in software development, yet their security implications remain poorly understood. These agents, while capable of accelerating software development, may inadvertently introduce insecure practices. We conducted the first systematic security...

CVE-2025-30403

A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to v2025.07.07.00. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Produ...

CVE-2025-48924

An uncontrolled recursion flaw was found in the Apache Commons Lang library. The ClassUtils.getClass... method can throw a StackOverflowError on very long inputs. Since this error is typically not handled by applications and libraries, a StackOverflowError may lead to the termination of an...

CVE-2025-5992

A denial of service flaw has been discovered in the Qt library. A call to QColorTransferGenericFunction may cause a crash if passed a maliciously crafted ICC profile. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

CVE-2025-3933

A regular expression denial of service flaw has been discovered in the Hugging Face Transformers library. The DonutProcessor class's token2json method may consume excessive CPU resources given maliciously designed input. Mitigation Mitigation for this issue is either not available or the currentl...

CVE-2025-53864

A denial of service flaw has been discovered in Connect2id Nimbus JOSE + JWT. This issue can allow a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set. Mitigation Mitigation for this issue is either not available or the currently available...

CVE-2025-7381

ImpactThis is an information disclosure vulnerability originating from PHP's base image. This vulnerability exposes the PHP version through an X-Powered-By header, which attackers could exploit to fingerprint the server and identify potential weaknesses. WorkaroundsThe mitigation requires changin...

UBUNTU-CVE-2025-51591

A Server-Side Request Forgery SSRF in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe. Note: Some users have stated that Pandoc by default can retrieve and parse untrusted HTML content which can enable SSRF vulnerabilitie...

arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users

...

CVE-2025-52520

A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits. Mitigation Mitigation for this issue is either not available or the currently available options d...