Huawei EulerOS: Security Advisory for krb5 (EulerOS-SA-2025-2331)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for cmake (EulerOS-SA-2025-2349)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for mod_http2 (EulerOS-SA-2025-2423)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990788)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990788 advisory. In the Linux kernel, the following vulnerability has been resolved: net: tunnels: annotate lockless accesses to dev-neededheadroom IP tunnels can apparently update...

PT-2025-45409

Name of the Vulnerable Software and Affected Versions WP Airbnb Review Slider plugin for WordPress versions up to and including 4.2 Description The WP Airbnb Review Slider plugin for WordPress is susceptible to Stored Cross-Site Scripting through admin settings. Insufficient URL validation allows...

Prevalence of Security and Privacy Risk-Inducing Usage of AI-Based Conversational Agents

Recent improvement gains in large language models LLMs have lead to everyday usage of AI-based Conversational Agents CAs. At the same time, LLMs are vulnerable to an array of threats, including jailbreaks and, for example, causing remote code execution when fed specific inputs. As a result, users...

Fedora: Security Advisory (FEDORA-2025-5872b9ec46)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-43931

Name of the Vulnerable Software and Affected Versions Wisencode versions prior to 20251013 Description A security flaw exists in Wisencode up to version 20251012. This issue affects an unknown functionality within the Create Support Ticket Handler component, specifically the file...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in DisposalDaemon.java. In high-core environments under heavy load, the disposal thread can fall behind and allow excessive memory use. Note This issue was reported for environments...

PT-2025-43499

Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description An issue exists in Android related to insufficient protection of service data. Exploitation may allow an attacker to disclose protected information. A potential out-of-bounds read due to a...

CVE-2025-22166

This High severity DoS Denial of Service vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely...

CVE-2025-11915 HTTP Desynchronisation in Vertex AI for certain third-party models

Connection desynchronization between an HTTP proxy and the model backend. The fixes were rolled out for all proxies in front of impacted models by 2025-09-28. Users do not need to take any action...

CVE-2025-41724 Sauter: Crash via Incomplete SOAP Request

An unauthenticated remote attacker can crash the wscserver by sending incomplete SOAP requests. The wscserver process will not be restarted by a watchdog and a device reboot is necessary to make it work again...

PT-2025-43128

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.5.0-syzkaller-00453-g727dbda16b83 Description The Linux kernel contains an issue within the networking scheduler related to the fq pie Fair Queueing Packet Identifier implementation. Specifically, the fq pie...

PT-2025-43166

Name of the Vulnerable Software and Affected Versions Captcha.eu versions n/a through 1.0.61 Description A Server-Side Request Forgery SSRF vulnerability exists in Captcha.eu captcha-eu. This allows for Server Side Request Forgery. Recommendations Update Captcha.eu to a version greater than 1.0.6...

PT-2025-43265

Name of the Vulnerable Software and Affected Versions Bob Likert Survey Master versions through 0.8.0.1 Description The software contains a flaw related to improper handling of user-supplied data when creating web pages, potentially leading to Reflected Cross-site Scripting XSS. This means an...

PT-2025-42888

Name of the Vulnerable Software and Affected Versions Mbed TLS versions through 3.6.4 Description Mbed TLS contains an Observable Timing Discrepancy. This issue may allow for timing attacks. Recommendations Update to a version of Mbed TLS newer than 3.6.4...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack via the IsValidWebAuthRedirectURL function. An attacker can obtain sensitive information such as Cloud API keys and OAuth client secrets by analyzing response times during authentication attempts. Remediation Upgrade...

Malicious Package

Overview vite-linting-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview package-f is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...