PT-2025-51980

Name of the Vulnerable Software and Affected Versions Zerobyte versions prior to 0.18.5 Zerobyte versions prior to 0.19.0 Description Zerobyte, a backup automation tool, has an issue where authentication middleware is not correctly applied to certain API endpoints. This allows access to these...

EUVD-2025-203840

PyMdown Extensions has a ReDOS bug in its Figure Capture extension...

CVE-2025-68142 PyMdown Extensions has ReDOS bug in Figure Capture extension

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. Versions prior to 10.16.1 have a ReDOS bug found within the figure caption extension pymdownx.blocks.caption. In systems that take unchecked user content, this could cause long hanges when processing the data if a...

[SECURITY] [DLA 4412-1] glib2.0 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4412-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort December 16, 2025 https://wiki.debian.org/LTS -...

Malicious Package

Overview prod-natwest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

PT-2025-51773

Name of the Vulnerable Software and Affected Versions filelock versions prior to 3.20.1 Description filelock is a platform-independent file lock for Python. A Time-of-Check-Time-of-Use TOCTOU race condition allows local attackers to corrupt or truncate arbitrary user files through symlink attacks...

Debian dla-4413 : node-url-parse - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4413 advisory. - ----------------------------------------------------------------------- Debian LTS Advisory DLA-4413-1 [email protected] https://www.debian.org/lts/security/...

Linux Distros Unpatched Vulnerability : CVE-2025-68146

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check- Time-of-Use TOCTOU race condition allows local attackers...

Ubuntu: Security Advisory (USN-7931-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-14503 Overly Permissive Trust Policy in Harmonix on AWS EKS

An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any IAM...

CVE-2025-40311 affecting package kernel for versions less than 6.6.117.1-1

CVE-2025-40311 affecting package kernel for versions less than 6.6.117.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-40040 affecting package kernel for versions less than 6.6.117.1-1

CVE-2025-40040 affecting package kernel for versions less than 6.6.117.1-1. An upgraded version of the package is available that resolves this issue...

Security Bulletin: Rational Performance Tester contains vulnerabilities which could affect its use of the MIME4J library

Summary Due to the use of the MIME4J library, Rational Performance Tester contains vulnerabilities that could result in improper input validation. Vulnerability Details CVEID:CVE-2024-21742 DESCRIPTION: Improper input validation allows for header injection in MIME4J library when using MIME4J DOM...

EUVD-2025-203314

A vulnerability was detected in Mayan EDMS up to 4.10.1. The affected element is an unknown function of the file /authentication/. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 4.10.2 is...

GHSA-774Q-R975-VQWP Mayan EDMS is vulnerable to XSS through the /authentication/ file

A vulnerability was detected in Mayan EDMS up to 4.10.1. The affected element is an unknown function of the file /authentication/. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 4.10.2 is...

CVE-2025-14691 Mayan EDMS authentication cross site scripting

A vulnerability was detected in Mayan EDMS up to 4.10.1. The affected element is an unknown function of the file /authentication/. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 4.10.2 is...

CVE-2025-58130

Insufficiently Protected Credentials vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.11.0. The issue is fixed in version 1.12.1. Users are encouraged to upgrade to version 1.13.0, the latest release...

TorchGeo Remote Code Execution Vulnerability

Impact TorchGeo 0.4–0.6.0 used an ""eval"" https://docs.python.org/3/library/functions.htmleval statement in its model weight API that could allow an unauthenticated, remote attacker to execute arbitrary commands. All platforms that expose ""torchgeo.models.getweight""...

EUVD-2025-203115

A security vulnerability has been detected in Qualitor up to 8.24.73. The impacted element is an unknown function of the file /Qualitor/html/bc/bcdocumento9/biblioteca/request/viewDocumento.php. Such manipulation of the argument cdscript leads to cross site scripting. It is possible to launch the...

CVE-2025-14580 Qualitor viewDocumento.php cross site scripting

A security vulnerability has been detected in Qualitor up to 8.24.73. The impacted element is an unknown function of the file /Qualitor/html/bc/bcdocumento9/biblioteca/request/viewDocumento.php. Such manipulation of the argument cdscript leads to cross site scripting. It is possible to launch the...