Use of GET Request Method With Sensitive Query Strings

Overview Affected versions of this package are vulnerable to Use of GET Request Method With Sensitive Query Strings in the c.IsTokenAuth checks in API routes. An attacker can obtain sensitive access tokens by inspecting URL parameters in logs, browser history, or referrer headers. Remediation...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the logging process. An attacker can obtain sensitive S3 access credentials by accessing the pod's logs. Remediation Upgrade github.com/rancher/backup-restore-operator/pkg/objectstore ...

Cleartext Storage of Sensitive Information

Overview Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information in in Azure Compute Gallery, which writes MAA tokens in the debug log. Remediation Upgrade github.com/Microsoft/confidential-sidecar-containers/pkg/common to version 2.12 or higher. References ...

Debian dsa-6120 : libtomcat10-embed-java - security update

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6120 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6120-1 [email protected]...

Debian dla-4449 : libzvbi-common - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4449 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4449-1 [email protected]...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation due to trusting reverse-proxy headers by default. An attacker can bypass IP-based access restrictions by crafting requests with malicious X-Forwarded-For headers. Remediation Upgrade...

Debian dla-4392 : python3-mistral-dashboard - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4392 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4392-1 [email protected] https://www.debian.org/lts/security/...

PT-2025-48260

Name of the Vulnerable Software and Affected Versions KDE Connect versions prior to 25.04.2-1+deb13u1 gnome-shell-extension-gsconnect versions prior to 62-1+deb13u1 Description A missing validation of the device ID during handshakes in KDE Connect and gnome-shell-extension-gsconnect could allow a...

[SECURITY] [DLA 4380-1] cups-filters security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4380-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz November 25, 2025 https://wiki.debian.org/LTS -...

Slackware: Security Advisory (SSA:2025-324-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 6051-1] incus security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6051-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 10, 2025 https://www.debian.org/security/faq -...

[slackware-security] seamonkey

New seamonkey packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/seamonkey-2.53.22-i686-1slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more information, see:...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the enforcer that uses environment variables without sanitation. An attacker can execute arbitrary commands or cause a buffer overflow by supplying crafted input to the affected component. Remediation Upgrade...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via manipulation of the Forwarded or X-Forwarded-Host headers used to construct password reset confirmation links. An attacker can gain unauthorized access to user accounts by tricking users into clicking a password reset...

Files or Directories Accessible to External Parties

Overview Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties via the secure persistent volume feature. An attacker can access confidential data stored in persistent volumes by providing a crafted LUKS2 volume with a null key-encryption algorithm...

Unsafe Dependency Resolution

Overview Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the core.fsmonitor configuration option in the .git/config file. An attacker can execute arbitrary code by convincing a user or tool to scan a specially crafted repository that contains a malicious...

Fedora: Security Advisory (FEDORA-2025-ab3c40c1f4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[slackware-security] python3

New python3 packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/python3-3.9.24-i586-1slack15.0.txz: Upgraded. This update fixes bugs and security issues. For details, see...

EUVD-2017-18222

Malware in sbrugna...

CVE-2025-38601 affecting package kernel for versions less than 6.6.104.2-1

CVE-2025-38601 affecting package kernel for versions less than 6.6.104.2-1. An upgraded version of the package is available that resolves this issue...