Vulnerabilities fixed in React Server Components

React has fixed vulnerabilities in certain versions of React Server Components specifically for versions 19.0.0, 19.1.0, 19.1.1 and 19.2.0. An unauthenticated attacker can send a rogue HTTP request to any Server Function endpoint that, when processed by React, can lead to remote code execution on...

Important Photon OS Security Update - PHSA-2025-5.0-91-0705

Updates of 'linux', 'linux-esx' packages of Photon OS have been released...

MGASA-2025-0320 Updated python-django packages fix security vulnerabilities

Potential SQL injection in FilteredRelation column aliases on PostgreSQL. CVE-2025-13372 Potential denial-of-service vulnerability in XML serializer text extraction. CVE-2025-64460...

Updated webkit2 packages fix security vulnerabilities

The updated packages fix security vulnerabilities: CVE-2025-43392, CVE-2025-43419, CVE-2025-43425, CVE-2025-43427, CVE-2025-43429, CVE-2025-43430, CVE-2025-43431, CVE-2025-43432, CVE-2025-43434, CVE-2025-43440, CVE-2025-43443, CVE-2025-43421...

GHSA-7C64-F9JR-V9H2 vulnerabilities

Vulnerabilities for packages: helm-push, incert, rancher-system-agent, gitness, tfsec, custom-pod-autoscaler, sftpgo-plugin-eventstore, gitaly, nri-haproxy, grpcurl, k9s, k8sgpt, temporal, pgpool2exporter, terraform-provider-random, aws-privateca-issuer, sftpgo, spicedb, temporal-server,...

CVE-2025-29846

A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages...

CVE-2025-29846

A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages...

CVE-2025-29846

The CVE-2025-29846 issue affects Synology Router Manager (SRM) via the portenable CGI. The vulnerability allows remote authenticated users to obtain the status of installed packages, indicating an information disclosure through the portenable CGI endpoint. The provided documents do not specify af...

CVE-2025-29846

A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages...

CVE-2025-29846

A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages...

EUVD-2025-201172

A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages...

Adobe Experience Manager (AEM) CRX Package Manager Panel Detected

This plugin detects the presence of the Adobe Experience Manager AEM CRX Package Manager panel on a web application. The CRX Package Manager is a tool used to manage packages in AEM, allowing users to install, uninstall, and manage content packages. No source data...

Important Photon OS Security Update - PHSA-2025-5.0-91-0702

Updates of 'linux', 'linux-esx' packages of Photon OS have been released...

CVE-2025-29846: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages...

Linux Distros Unpatched Vulnerability : CVE-2025-40258

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mptcp: fix race condition in mptcpschedulework syzbot reported use-after-free in mptcpschedulework 1 Issue here is that mptcpschedulework schedules a work, the...

Slackware Linux 15.0 / current libpng Vulnerability (SSA:2025-338-02)

The version of libpng installed on the remote host is prior to 1.6.52. It is, therefore, affected by a vulnerability as referenced in the SSA:2025-338-02 advisory. New libpng packages are available for Slackware 15.0 and -current to fix a security issue. Tenable has extracted the preceding...

Fedora: Security Advisory (FEDORA-2025-0cc929ff17)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Exploit for CVE-2025-55182

CVE-2025-55182 - React Server Components Pre-Auth RCE Exec...

Updated cups packages fix security vulnerabilities

The updated packages fix security vulnerabilities and a regression with GTK+ apps caused by the fix for CVE-2025-58436: OpenPrinting CUPS slow client can halt cupsd, leading to a possible DoS attack. CVE-2025-58436 OpenPrinting CUPS vulnerable to stack based out-of-bound write. CVE-2025-61915...

Shai Hulud 2.0, now with a wiper flavor

In September, a new breed of malware distributed via compromised Node Package Manager npm packages made headlines. It was dubbed "Shai-Hulud", and we published an in-depth analysis of it in another post. Recently, a new version was discovered. Shai Hulud 2.0 is a type of two-stage worm-like malwa...