AZL-65654 CVE-2025-54090 affecting package httpd for versions less than 2.4.65-1

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recommended to upgrade to version 2.4.65, which fixes the issue...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to signature forgery due to the node-forge package (CVE-2022-24771, CVE-2022-24772 )

Summary Node-forge is used by DataStage on Cloud Pak for Data as part of connection encryption. Vulnerability Details CVEID:CVE-2022-24771 DESCRIPTION: Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signatu...

CVE-2025-54090

Summary of CVE-2025-54090 : The issue affects Apache HTTP Server, specifically version 2.4.64, where all "RewriteCond expr ..." tests evaluate as true due to a bug in the expression evaluation. The remedy is to upgrade to version 2.4.65, which includes the fix. The provided connected documents co...

Security Bulletin: IBM OpenPages is affected by multiple security vulnerabilities of DB2 Database Server (May 2025)

Summary IBM® Db2® Database Server is shipped as a supporting program of IBM OpenPages. Information about security vulnerabilities affecting IBM Db2 Database Server has been published in multiple security bulletins. Vulnerability Details Refer to the security bulletins listed in the...

PT-2025-30566 · Dj-Flyer · Dj-Flyer

Name of the Vulnerable Software and Affected Versions: DJ-Flyer versions 1.0 through 3.2 Description: A SQL injection issue exists in the DJ-Flyer component. The vulnerability allows privileged users to execute arbitrary SQL commands. Recommendations: Update DJ-Flyer to a version later than 3.2...

PT-2025-30515 · WordPress · Omnishop

Name of the Vulnerable Software and Affected Versions: Omnishop plugin for WordPress versions up to and including 1.0.9 Description: The Omnishop plugin for WordPress is susceptible to unauthenticated registration bypass. The /users/register API endpoint is publicly exposed and unconditionally...

PT-2025-30617 · Pinokio · Pinokio

Name of the Vulnerable Software and Affected Versions: Pinokio version 3.6.23 Description: A URL redirection issue exists in Pinokio version 3.6.23, allowing attackers to redirect users to attacker-controlled pages. Recommendations: Update Pinokio to a newer version that addresses this issue...

PT-2025-30530 · Samsung · Magicinfo 9 Server

Name of the Vulnerable Software and Affected Versions: MagicINFO 9 Server versions prior to 21.1080.0 Description: A flaw exists in Samsung Electronics MagicINFO 9 Server that allows code injection through the unrestricted upload of files with dangerous types. Recommendations: Update MagicINFO 9...

PT-2025-30512 · WordPress · Yanewsflash

Name of the Vulnerable Software and Affected Versions: YANewsflash plugin for WordPress versions prior to 1.0.4 Description: The YANewsflash plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the yanewsflash/yanewsflash.php page. This...

PT-2025-30525 · Bun · Bun

Name of the Vulnerable Software and Affected Versions: bun versions prior to 0.0.12 Description: The package bun is susceptible to Improper Neutralization of Special Elements used in an OS Command OS Command Injection within the $shell API. This issue stems from inadequate neutralization of...

PT-2025-30624

Name of the Vulnerable Software and Affected Versions: Axios version 1.10.0 Description: A flaw in the form-data package, used by Axios, allows attackers to predict multipart boundaries, potentially leading to HTTP parameter pollution and injection. Recommendations: Update to version 1.11.0...

PT-2025-30527 · Samsung · Magicinfo 9 Server

Name of the Vulnerable Software and Affected Versions: MagicINFO 9 Server versions prior to 21.1080.0 Description: An unrestricted file upload issue with dangerous file types exists in Samsung Electronics MagicINFO 9 Server, potentially leading to code injection. Recommendations: Update MagicINFO...

PT-2025-30540 · Samsung · Magicinfo 9 Server

Name of the Vulnerable Software and Affected Versions: MagicINFO 9 Server versions prior to 21.1080.0 Description: An improper authentication issue exists in MagicINFO 9 Server, allowing authentication bypass. Recommendations: Update MagicINFO 9 Server to version 21.1080.0 or later...

PT-2025-30570 · Unknown · Joomla Ccomment

Name of the Vulnerable Software and Affected Versions: Joomla CComment component versions 5.0.0 through 6.1.14 Description: A stored cross-site scripting XSS issue exists in the CComment component. This allows an attacker to inject malicious scripts into the application, potentially compromising...

PT-2025-30528 · Samsung · Magicinfo 9 Server

Name of the Vulnerable Software and Affected Versions: MagicINFO 9 Server versions prior to 21.1080.0 Description: A flaw exists in Samsung Electronics MagicINFO 9 Server that allows code injection through the unrestricted upload of files with dangerous types. Recommendations: Update MagicINFO 9...

PT-2025-30533 · Samsung · Magicinfo 9 Server

Name of the Vulnerable Software and Affected Versions: MagicINFO 9 Server versions prior to 21.1080.0 Description: The software contains an Improper Restriction of XML External Entity Reference vulnerability that allows Server Side Request Forgery. Recommendations: Update MagicINFO 9 Server to...

PT-2025-30568 · Joomla · Dj-Reviews

Name of the Vulnerable Software and Affected Versions: DJ-Reviews versions 1.0 through 1.3.6 Description: A Reflected Cross-Site Scripting XSS issue exists in the DJ-Reviews component for Joomla. This allows an attacker to inject malicious scripts into a web page viewed by other users...

PT-2025-30616 · Unknown · Lbry-Desktop

Name of the Vulnerable Software and Affected Versions: lbry-desktop version 0.53.9 Description: A URL redirection issue exists in lbry-desktop version 0.53.9, potentially allowing attackers to redirect users to malicious websites. Recommendations: Update lbry-desktop to a newer version that...

PT-2025-30514 · WordPress · Omnishop

Name of the Vulnerable Software and Affected Versions: Omnishop versions up to and including 1.0.9 Description: The Omnishop plugin for WordPress is susceptible to Cross-Site Request Forgery on its /users/delete REST route. The route’s permission callback only verifies that the requester is logge...

PT-2025-30567 · Komento +1 · Komento +1

Name of the Vulnerable Software and Affected Versions: Komento versions 4.0.0 through 4.0.7 Description: A SQL injection flaw exists in the Komento component for Joomla. This issue permits unprivileged users to execute arbitrary SQL commands. Recommendations: Update Komento to a version newer tha...