Linux Distros Unpatched Vulnerability : CVE-2025-38525

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix irq-disabled in localbhenable The rxrpcassessMTUsize function calls down into the...

Linux Distros Unpatched Vulnerability : CVE-2021-33938

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer overflow vulnerability in function prunetorecommended in src/policy.c in libsolv before 0.7.17 allows attackers to cause a Denial of Service...

CVE-2025-57752 Next.js Affected by Cache Key Confusion for Image Optimization API Routes

Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization API routes are affected by cache key confusion. When images returned from API routes vary based on request headers such as Cookie or...

CVE-2025-57822 Next.js Improper Middleware Redirect Handling Leads to SSRF

Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has...

Next.js Improper Middleware Redirect Handling Leads to SSRF

A vulnerability in Next.js Middleware has been fixed in v14.2.32 and v15.4.7. The issue occurred when request headers were directly passed into NextResponse.next. In self-hosted applications, this could allow Server-Side Request Forgery SSRF if certain sensitive headers from the incoming request...

Insufficient Session Expiration

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Insufficient Session Expiration due to the failure to invalidate JSON Web Tokens after user log out. An attacker can maintain unauthorised access by reusing a...

CVE-2025-9604 coze-studio aes.go hard-coded key

A vulnerability was identified in coze-studio up to 0.2.4. The impacted element is an unknown function of the file backend/domain/plugin/encrypt/aes.go. The manipulation of the argument AuthSecretKey/StateSecretKey/OAuthTokenSecretKey leads to use of hard-coded cryptographic key . It is possible ...

PT-2025-35260

Name of the Vulnerable Software and Affected Versions: File Station versions prior to 5.5.6.4907 Description: A NULL pointer dereference issue exists in File Station 5. A remote attacker gaining a user account can exploit this to launch a denial-of-service DoS attack. Recommendations: Update to...

PT-2025-35291

Name of the Vulnerable Software and Affected Versions: HybridDesk Station versions prior to 4.2.18 Description: A command injection vulnerability exists in HybridDesk Station. An attacker with local network access can exploit this issue to execute arbitrary commands. Recommendations: Update to...

Security Bulletin: IBM Guardium Data Protection is affected by an SQL Injection via username vulnerability (CVE-2024-55906).

Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2024-55906 DESCRIPTION: IBM Security Guardium is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view,...

Debian dla-4285 : golang-github-gin-contrib-cors-dev - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4285 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4285-1 [email protected] https://www.debian.org/lts/security/...

CVE-2025-34520

An authentication bypass vulnerability in Arcserve Unified Data Protection UDP allows unauthenticated attackers to gain unauthorized access to protected functionality or user accounts. By manipulating specific request parameters or exploiting a logic flaw, an attacker can bypass login mechanisms...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in axios-1.6.1.tgz

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of axios-1.6.1.tgz Vulnerability Details CVEID:CVE-2025-27152 DESCRIPTION: axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to...

PT-2025-34821 · WordPress · Lazy Load For Videos

Name of the Vulnerable Software and Affected Versions: Lazy Load for Videos plugin for WordPress versions through 2.18.7 Description: The Lazy Load for Videos plugin for WordPress is susceptible to Stored Cross-Site Scripting through its lazy-loading handlers. Insufficient input sanitization and...

PT-2025-34913 · Unknown · Simple Download Monitor

Name of the Vulnerable Software and Affected Versions: Simple Download Monitor versions through 3.9.34 Description: The software contains a cross-site scripting XSS issue due to improper neutralization of input during web page generation. This allows for stored XSS attacks. Recommendations: Updat...

PT-2025-34833 · Unknown · Printeers Print & Ship

Name of the Vulnerable Software and Affected Versions: Printeers Print & Ship versions through 1.17.0 Description: The software contains a path traversal flaw. An attacker can exploit this issue by utilizing a '.../...//' path to traverse directories. Recommendations: Update Printeers Print & Shi...

Linux Distros Unpatched Vulnerability : CVE-2024-53868

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, from 10.0....

PT-2025-34912 · Unknown · Uicore Elements

Name of the Vulnerable Software and Affected Versions: UiCore Elements versions through 1.3.4 Description: The software contains a Stored Cross-Site Scripting XSS issue due to improper neutralization of input during web page generation. This allows for the injection of malicious scripts into web...

[SECURITY] [DSA 5986-1] node-cipher-base security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5986-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 26, 2025 https://www.debian.org/security/faq -...

CVE-2025-57818

CVE-2025-57818 : Firecrawl prior to version 2.0.1 contains an SSRF vulnerability in its webhook functionality. Authenticated users could configure a webhook to an internal URL and send POST requests with arbitrary headers, potentially enabling access to internal systems. The issue is fixed in ver...