Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in Bouncy Castle Crypto Package For Java

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of Bouncy Castle Crypto Package For Java Vulnerability Details CVEID:CVE-2024-30171 DESCRIPTION: The Bouncy Castle Crypto Package For Java could allow a remote authenticated attacker to obtain sensitive information, caused by...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in Natural Language Toolkit (NLTK)

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of Natural Language Toolkit NLTK Vulnerability Details CVEID:CVE-2024-39705 DESCRIPTION: Natural Language Toolkit NLTK could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when an untrusted...

CVE-2022-49381

In the Linux kernel, the following vulnerability has been resolved: jffs2: fix memory leak in jffs2dofillsuper If jffs2iget or dmakeroot in jffs2dofillsuper returns an error, we can observe the following kmemleak report: -------------------------------------------- unreferenced object...

CVE-2022-49255

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix missing free nid in f2fshandlefailedinode This patch fixes xfstests/generic/475 failure. 293.680694 F2FS-fs dm-1: May loss orphan inode, run fsck to fix. 293.685358 Buffer I/O error on dev dm-1, logical block 8388592,...

Mageia: Security Advisory (MGASA-2025-0074)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RockyLinux 9 : postgresql:15 (RLSA-2025:1741)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:1741 advisory. postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation CVE-2025-1094 Tenable has extracted the preceding...

Dell SupportAssist OS Recovery Symbolic Link Attack (DSA-2025-051)

According to its self-reported version number, the version of Dell SupportAssist OS Recovery is affected by a symbolic link attack vulnerability. A low-privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary file deletion and Elevation of Privilege...

GHSA-MCQX-PMH8-V9CR vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-WQ96-W9CG-V635 vulnerabilities

Vulnerabilities for packages: mysql...

GHSA-7XJC-VRM4-R82F vulnerabilities

Vulnerabilities for packages: mysql...

openSUSE Security Advisory (SUSE-SU-2024:0529-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AlmaLinux 8 : postgresql:13 (ALSA-2025:1736)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:1736 advisory. postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation CVE-2025-1094 Tenable has extracted the preceding...

openSUSE Security Advisory (SUSE-SU-2024:1270-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Advisory (SUSE-SU-2024:0820-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-H697-W4PH-7PCX Moodle has a stored XSS in ddimageortext question type

The drag-and-drop onto image ddimageortext question type required additional sanitizing to prevent a stored XSS risk...

CVE-2025-26529

Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk...

XOne Web Monitor 02.10.2024.530 SQL Injection

An unauthenticated SQL injection vulnerability has been discovered in the login functionality of XOne Web Monitor version 02.10.2024.530 framework 1.0.4.9. This flaw allows attackers to exploit improper handling of user input during the authentication process to extract all stored usernames and...

PT-2025-7609 · Full · Full

Name of the Vulnerable Software and Affected Versions: FULL Customer versions 3.1.26 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' or PHP Local File Inclusion vulnerability...

CVE-2025-27104

vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the iterator expression cannot produce multiple writes, it can consume side effects produced in the loop body e.g. read a storage variable...

CVE-2025-27106 Code injection in binance-trading-bot

binance-trading-bot is an automated Binance trading bot with trailing buy/sell strategy. Authenticated users of binance-trading-bot can achieve Remote Code Execution on the host system due to a command injection vulnerability in the /restore endpoint. The restore endpoint of binance-trading-bot i...