[SECURITY] [DLA 4425-1] python-django security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4425-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb December 29, 2025 https://wiki.debian.org/LTS -...

PT-2025-53869

Name of the Vulnerable Software and Affected Versions SimpleCalendar versions through 3.5.9 Description An authorization bypass exists due to user-controlled key vulnerability in Google Calendar Events. This allows exploitation of incorrectly configured access control security levels...

PT-2025-54206

Name of the Vulnerable Software and Affected Versions Edimax BR-6208AC versions 1.02 through 1.03 Description A flaw exists in the Web-based Configuration Interface component of Edimax BR-6208AC versions 1.02 and 1.03. This issue is related to the formALGSetup function within the...

PT-2025-53892

Name of the Vulnerable Software and Affected Versions Themebeez Toolkit versions through 1.3.5 Description A missing authorization flaw exists in Themebeez Toolkit, allowing exploitation of incorrectly configured access control security levels. Recommendations Update Themebeez Toolkit to a versio...

PT-2025-54174

Name of the Vulnerable Software and Affected Versions sunhailin12315 product-review 商品评价系统 versions up to 91ead6890b4065bb45b7602d0d73348e75cb4639 Description A security flaw exists in the sunhailin12315 product-review 商品评价系统. The issue is related to cross site scripting, which can be triggered b...

PT-2025-53909

Name of the Vulnerable Software and Affected Versions BoldGrid weForms versions through 1.6.25 Description An authorization issue exists in BoldGrid weForms that allows exploitation due to incorrectly configured access control security levels. Recommendations Update BoldGrid weForms to a version...

[SECURITY] [DLA 4424-1] openjpeg2 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4424-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès December 29, 2025 https://wiki.debian.org/LTS -...

Security Bulletin: Vulnerability in Spring Framework MVC affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Spring Framework MVC has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

Security Bulletin: IBM Edge Data Collector uses brace-expansion-1.1.11.tgz which is vulnerable to CVE-2025-5889.

Summary IBM Edge Data Collector uses brace-expansion-1.1.11.tgz which is vulnerable to CVE-2025-5889. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2025-5889 DESCRIPTION: A vulnerability was found in juliangruber brace-expansion up to...

PT-2025-53747

Name of the Vulnerable Software and Affected Versions INVELITY Invelity SPS connect versions through 1.0.8 Description A flaw exists in INVELITY Invelity SPS connect that allows for Reflected Cross-Site Scripting XSS. This occurs due to improper neutralization of input during web page generation...

PT-2025-53646

Name of the Vulnerable Software and Affected Versions ZSPACE Z4Pro+ version 1.0.0440024 Description A command injection issue exists in ZSPACE Z4Pro+. The issue is located within the HTTP POST Request Handler component, specifically in the zfilev2 api SafeStatus function accessible via the...

PT-2025-53626

Name of the Vulnerable Software and Affected Versions jackq XCMS versions prior to 3fab5342cc509945a7ce1b8ec39d19f701b89261 Description A flaw exists in jackq XCMS that allows for unrestricted file upload. The issue is located in the Upload function within the...

NewStart CGSL MAIN 7.02 : binutils Multiple Vulnerabilities (NS-SA-2025-0255)

The remote NewStart CGSL host, running version MAIN 7.02, has binutils packages installed that are affected by multiple vulnerabilities: - A vulnerability classified as critical has been found in GNU Binutils up to 2.44. This affects the function debugtypesamep of the file /binutils/debug.c of th...

NewStart CGSL MAIN 7.02 : gcc Multiple Vulnerabilities (NS-SA-2025-0254)

The remote NewStart CGSL host, running version MAIN 7.02, has gcc packages installed that are affected by multiple vulnerabilities: - A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43. This affects the function disassemblebytes of the file...

Debian dla-4422 : pgbouncer - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4422 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4422-1 [email protected] https://www.debian.org/lts/security/...

CVE-2025-15099

CVE-2025-15099 affects simstudioai sim up to version 0.5.27, specifically the CRON Secret Handler’s file apps/sim/lib/auth/internal.ts. The vulnerability arises from manipulation of the INTERNAL_API_SECRET parameter, enabling improper authentication. It is exploitable remotely, and publicly avail...

EUVD-2025-205409

A vulnerability was found in Alteryx Server. Affected by this issue is some unknown functionality of the file /gallery/api/status/. Performing manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used...

PT-2025-53441

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.21.8 Description The software reveals user login times due to allowing sorting by last login time in the explore/users section. Recommendations Update to version 1.21.8 or later...

PT-2025-53410

Name of the Vulnerable Software and Affected Versions UTT 进取 512W versions through 1.7.7-171114 Description A flaw exists in UTT 进取 512W that allows for remote buffer overflow. The issue is related to the strcpy function within the /goform/ConfigExceptMSN file. Manipulation of the remark argument...

PT-2025-53402

Name of the Vulnerable Software and Affected Versions Aidango versions prior to 2.144.4 Description Aidango is susceptible to a Cross-Site Scripting XSS issue due to improper neutralization of input during web page generation. XSS occurs when an application includes malicious code in a web page...