Linux Distros Unpatched Vulnerability : CVE-2022-23471

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI strea...

CVE-2025-9039

We identified an issue in the Amazon ECS agent where, under certain conditions, an introspection server could be accessed off-host by another instance if the instances are in the same security group or if their security groups allow incoming connections that include the port where the server is...

CVE-2025-55286

z2d is a pure Zig 2D graphics library. z2d v0.7.0 released with a new multi-sample anti-aliasing MSAA method, which uses a new buffering mechanism for storing coverage data. This differs from the standard alpha mask surface used for the previous super-sample anti-aliasing SSAA method. Under certa...

CVE-2025-55286

The CVE-2025-55286 issue affects z2d v0.7.0/v0.7.0-era MSAA buffering. Under scenarios where a drawn path lies wholly or partly outside the rendering surface, incorrect bounding can cause out-of-bounds access in the coverage buffer, impacting high-level operations (Context.fill/stroke, painter.fi...

CVE-2025-55286 z2d OOB drawing with new multi-sample anti-aliasing could lead to invalid memory access and corruption

z2d is a pure Zig 2D graphics library. z2d v0.7.0 released with a new multi-sample anti-aliasing MSAA method, which uses a new buffering mechanism for storing coverage data. This differs from the standard alpha mask surface used for the previous super-sample anti-aliasing SSAA method. Under certa...

HashiCorp go-getter Vulnerable to Arbitrary Read through Symlink Attack

Summary HashiCorp’s go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9. Background HashiCorp’s go-getter is a...

CVE-2025-8908

A vulnerability was determined in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.5.4. Affected by this issue is some unknown functionality of the file crm/WeiXinApp/yunzhijia/event.php. The manipulation of the argument openid leads to sql injection. The attack may be launched...

CVE-2025-9020 PX4 PX4-Autopilot Mavlink Shell Closing mavlink_receiver.cpp handle_message_serial_control use after free

A vulnerability was found in PX4 PX4-Autopilot up to 1.15.4. This issue affects the function MavlinkReceiver::handlemessageserialcontrol of the file src/modules/mavlink/mavlinkreceiver.cpp of the component Mavlink Shell Closing Handler. The manipulation of the argument mavlinkshell leads to use...

PT-2025-33509

Name of the Vulnerable Software and Affected Versions: Apple Music Classical versions prior to 2.3 Description: The issue was addressed with improved checks. An application may be able to unexpectedly leak a user's credentials. Recommendations: Update to Apple Music Classical version 2.3 or later...

PT-2025-33448 · WordPress +1 · Essential Addons For Elementor +1

Name of the Vulnerable Software and Affected Versions: Essential Addons for Elementor versions up to and including 6.2.2 Description: The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the...

Information Disclosure in Amazon ECS Container Agent

Summary Amazon Elastic Container Service Amazon ECS is a fully managed container orchestration service that enables customers to deploy, manage, and scale containerized applications. Amazon ECS container agent provides an introspection API that provides information about the overall state of the...

CVE-2025-9039

We identified an issue in the Amazon ECS agent where, under certain conditions, an introspection server could be accessed off-host by another instance if the instances are in the same security group or if their security groups allow incoming connections that include the port where the server is...

CVE-2025-9039 Information Disclosure in Amazon ECS Container Agent

We identified an issue in the Amazon ECS agent where, under certain conditions, an introspection server could be accessed off-host by another instance if the instances are in the same security group or if their security groups allow incoming connections that include the port where the server is...

Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability

A stored Cross-Site Scripting XSS vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they...

[SECURITY] [DLA 4272-1] aide security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4272-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz August 14, 2025 https://wiki.debian.org/LTS -...

[SECURITY] [DSA 5977-1] aide security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5977-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 14, 2025 https://www.debian.org/security/faq -...

Security Bulletin: IBM Planning Analytics is vulnerable to a Denial of Service due to the use of Apache Commons

Summary There is a vulnerability in one of the Open Source Software OSS components consumed by IBM Planning Analytics. This Security Bulletin relates only to the direct usage of third-party components by IBM Planning Analytics Workspace and not any nested dependencies within the product...

CVE-2025-55672 Apache Superset: Stored XSS on charts metadata

A stored Cross-Site Scripting XSS vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they...

CVE-2025-54472 Apache bRPC: Redis Parser Remote Denial of Service

Unlimited memory allocation in redis protocol parser in Apache bRPC all versions 1.14.1 on all platforms allows attackers to crash the service via network. Root Cause: In the bRPC Redis protocol parser code, memory for arrays or strings of corresponding sizes is allocated based on the integers re...

[SECURITY] [DSA 5976-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5976-1 [email protected] https://www.debian.org/security/ Andres Salomon August 14, 2025 https://www.debian.org/security/faq -...