Slackware Linux 15.0 / current cups Multiple Vulnerabilities (SSA:2025-255-01)

The version of cups installed on the remote host is prior to 2.4.14. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-255-01 advisory. New cups packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted the preceding...

[SECURITY] [DLA 4300-1] shibboleth-sp security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4300-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès September 14, 2025 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 4299-1] jetty9 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4299-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk September 14, 2025 https://wiki.debian.org/LTS -...

HTTP Request Smuggling

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to HTTP Request Smuggling via the bodyLimit middleware when conflicting HTTP headers are present. An attacker can cause excessive memory or CPU consumption by sending oversized request bodie...

OESA-2025-2243 tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: Apache Tomcat is vulnerable to...

PT-2025-37316

Name of the Vulnerable Software and Affected Versions: Hono versions prior to 4.9.7 Description: Hono is a Web application framework that provides support for any JavaScript runtime. A flaw in the bodyLimit middleware could allow bypassing the configured request body size limit when conflicting...

Advisory ROSA-SA-2025-2998

software: libvpx 1.10.0 OS: ROSA-CHROME unaffected versions = libvpx-1.10.0-5 affected versions libvpx-1.10.0-5 CVE-ID: CVE-2024-5197 BDU-ID: 2024-04531 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the vpximgalloc function of the libvpx video encoding/decoding library is related to integer...

Debian dsa-5996 : chromium - security update

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5996 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5996-1 [email protected]...

Google Chrome Security Update (stable-channel-update-for-desktop_9-2025-09) - Windows

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

Improper Validation of Certificate Expiration

Overview infrahub-server is an Infrahub is taking a new approach to Infrastructure Management by providing a new generation of datastore to organize and control all the data that defines how an infrastructure should run. Affected versions of this package are vulnerable to Improper Validation of...

OPEXUS FOIAXpress Public Access Link (PAL) SQL injection

RISK EVALUATION Successful exploitation could allow a remote, unauthenticated attacker to read, write, or delete any content in the underlying database. 2. RECOMMENDED PRACTICES Upgrade to FOIAXpress PAL version 11.13.1.0. 3. DESCRIPTION OPEXUS FOIAXpress Public Access Link PAL before version...

CVE-2025-58758

TinyEnv is an environment variable loader for PHP applications. In versions 1.0.1, 1.0.2, 1.0.9, and 1.0.10, TinyEnv did not require the .env file to exist when loading environment variables. This could lead to unexpected behavior where the application silently ignores missing configuration,...

CVE-2025-58758 TinyEnv: Missing .env file not required — may cause unexpected behavior

TinyEnv is an environment variable loader for PHP applications. In versions 1.0.1, 1.0.2, 1.0.9, and 1.0.10, TinyEnv did not require the .env file to exist when loading environment variables. This could lead to unexpected behavior where the application silently ignores missing configuration,...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection due to improper input validation in the alert script check. An attacker can execute arbitrary shell commands on the server by submitting crafted input after authentication. Remediation Upgrade...

[SECURITY] [DLA 4296-1] qemu security update

Debian LTS Advisory DLA-4296-1 [email protected] https://www.debian.org/lts/security/ Santiago Ruano Rincón September 08, 2025 https://wiki.debian.org/LTS Package : qemu Version : 1:5.2+dfsg-11+deb11u5 CVE ID : CVE-2024-7409 Debian Bug : 1111844 Two security issues were discovered in...

PT-2025-36568

Name of the Vulnerable Software and Affected Versions: Tautulli versions prior to 2.16.0 Description: Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The real pms image proxy endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read...

Malicious code in color (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3507ec02d0eb24c87e1f7621140bb5e6a4a343308e7ee8af79ef7f84617f8577 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-46982 Malicious code in supports-hyperlinks (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e6b84cdad651002e1e7ef0c1095ad079307474d09b03369f3b025eba0188e377 Any computer that has this package installed or running should be considered fully compromised. All...

[SECURITY] [DLA 4168-2] openafs regression update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4168-2 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz September 08, 2025 https://wiki.debian.org/LTS -...

RUSTSEC-2025-0061 iron crate is unmaintained

The iron crate is no longer actively maintained. If you rely on this crate, consider switching to a maintained alternative. Recommended alternatives See this comparison for popular alternatives...