Linux Distros Unpatched Vulnerability : CVE-2024-35968

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: pdscore: Fix pdsccheckpcihealth function to use work thread When the driver notices fwstatus...

CBL Mariner 2.0 Security Update: sqlite (CVE-2025-7458)

The version of sqlite installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-7458 advisory. - An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allow...

Linux Distros Unpatched Vulnerability : CVE-2025-38159

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 instead of 2, since 'para' array is passed to 'rtwfwbtwificontrolrtwde...

WordPress Radius Blocks plugin <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via subHeadingTagName Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via subHeadingTagName Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Radius Blocks versions = 2.2.1...

CVE-2025-55165

Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database. Prior to version 0.8.3, the debug pack generated by Autocaliweb can expose sensitive configuration data, including API keys. This occurs because the todict method, used ...

Malicious code in malicious-do-not-install (npm)

The package malicious-do-not-install was found to contain malicious code...

MAL-2025-28247 Malicious code in only-test-not-install (npm)

The package only-test-not-install was found to contain malicious code...

Malicious code in only-test-not-install (npm)

The package only-test-not-install was found to contain malicious code...

MAL-2025-25806 Malicious code in malicious-do-not-install (npm)

The package malicious-do-not-install was found to contain malicious code...

MAL-2025-14250 Malicious code in alb-um-availa-ble-zip-mp3-file-54131-not-for-threes-53dbe-butthc (npm)

The package alb-um-availa-ble-zip-mp3-file-54131-not-for-threes-53dbe-butthc was found to contain malicious code...

CVE-2025-53341

CVE-2025-53341 refers to a Missing Authorization/broken access control vulnerability in the WordPress Stratus theme (versions up to and including 4.2.5). The issue stems from incorrectly configured access control levels, enabling improper authorization under typical user roles. The CVSS metrics i...

CVE-2025-8713

PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this...

Free of Memory not on the Heap

Overview Affected versions of this package are vulnerable to Free of Memory not on the Heap in the TIFFCROP utility. An attacker can cause denial of service by triggering memory corruption through crafted input files. Remediation Upgrade libtiff to version 4.7.1 or higher. References - GitLab Iss...

WordPress WP Pipes Plugin <= 1.4.3 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by LVT-tholv2k in WordPress Plugin WP Pipes versions = 1.4.3...

Command Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Command Injection via the CustomMCP class. An attacker can gain unauthorized remote access and execute arbitrary operating system commands by sending crafted requests over the network. This i...

CGA-H88Q-2F54-3324

Bulletin has no description...

MINI-6XQF-PH7F-497H

Bulletin has no description...

CVE-2025-26398

SolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key. If exploited, this vulnerability could lead to a machine-in-the-middle MITM attack against users. This vulnerability requires additional software not installed by default, local access to the server and...

Rockwell Automation 1756-EN4TR, 1756-EN4TRXT (Update B)

RISK EVALUATION Successful exploitation of these vulnerabilities could result in an attacker causing a denial of service condition. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network...

Rockwell Automation FactoryTalk Viewpoint

RISK EVALUATION Successful exploitation of this vulnerability could result in full privilege escalation. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control system...