PT-2025-4269 · Oracle · Oracle Hospitality Opera 5

Name of the Vulnerable Software and Affected Versions: Oracle Hospitality OPERA 5 versions 5.6.19.20 through 5.6.27.1 Description: This issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5. Successful attacks can result in unauthorized...

PT-2025-5261

Name of the Vulnerable Software and Affected Versions YesWiki versions up to and including 4.4.5 Description The vulnerability allows any end-user to craft a DOM based XSS on all of YesWiki's pages, which is triggered when a user clicks on a malicious link. This issue makes use of the search by t...

OPENSUSE-SU-2025:14680-1 ruby3.4-rubygem-railties-8.0-8.0.1-1.1 on GA media

These are all security issues fixed in the ruby3.4-rubygem-railties-8.0-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2025-4816 · Brave · Brave Browser

Name of the Vulnerable Software and Affected Versions: Brave Browser versions 1.70.x through 1.73.x Description: The issue arises from a feature that displays a site's origin on the OS-provided file selector dialog when a site prompts the user to upload or download a file. However, the origin is...

CVE-2025-23219 WeGIA has a SQL Injection endpoint 'adicionar_cor.php' parameter 'cor'

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the WeGIA application, specifically in the adicionarcor.php endpoint. This vulnerability allows attackers to execute arbitrary SQL commands in t...

CVE-2025-23044 Cross-Site Request Forgery (CSRF) allows creating admin account with POST request

PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit...

CVE-2025-21648

CVE-2025-21648 affects the Linux kernel netfilter conntrack code. The vulnerability arises from the hashtable resize path where the maximum size could exceed practical limits, risking a WARN_ON_ONCE in __kvmalloc_node_noprof() when __GFP_NOWARN is unset. The fix clamps the conntrack hashtable siz...

CVE-2025-21631

CVE-2025-21631 is a Linux kernel UAF issue in the bfq I/O scheduler. The vulnerability arises from a use-after-free involving waker_bfqq after bfq_split_bfqq, leading to slab-use-after-free in bfq_init_rq as shown by the KASAN report. Affected code paths include bfq-iosched.c: bfq_init_rq/bfq_ins...

Fedora 41 : stb (2025-6a64d3b2fc)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-6a64d3b2fc advisory. Add another patch for the root cause of CVE-2021-45340. We already have a patch for CVE-2021-45340, but adding this new patch may prevent a related, unproven...

Security update for pam_u2f

This update for pamu2f fixes the following issues: CVE-2025-23013: Fixed problematic PAMIGNORE return values in pamsmauthenticate bsc1233517 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you ca...

GHSA-JHVJ-F397-8W6Q HAL Console has a Cross Site Scripting (XSS) vulnerability of user input

A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups...

matrix-media-repo (MMR) allows unauthenticated writes to the media repository, which may allow planting of problematic content

Impact MMR before version 1.3.5 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated wa...

SUSE-SU-2025:0143-1 Security update for apache2-mod_jk

This update for apache2-modjk fixes the following issues: - Update to version 1.2.50: - CVE-2024-46544: Fixed incorrect default permissions vulnerabilitymay that could lead to information disclosure and/or denial of service. bsc1230916...

CVE-2024-45337 affecting package docker-compose for versions less than 2.27.0-2

CVE-2024-45337 affecting package docker-compose for versions less than 2.27.0-2. A patched version of the package is available...

PT-2025-3565 · Jfinaloa · Jfinaloa

Name of the Vulnerable Software and Affected Versions: JFinalOA versions prior to 2025.01.01 Description: A cross-site scripting XSS issue in the "common/getEditPage?view" interface allows attackers to execute arbitrary web scripts or HTML via a crafted payload. This could potentially lead to the...

PT-2025-4889 · Unknown · Emailshroud

Name of the Vulnerable Software and Affected Versions: EmailShroud versions prior to 2.2.1 EmailShroud version 2.2.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Reflected XSS. This means an attacker can trick a user into performing unintended actions on a...

Crayfish allows Remote Code Execution via Homarus Authorization header

Impact Remote code execution may be possible in web-accessible installations of Homarus in certain configurations. Patches The issue has been patched in islandora/crayfish:4.1.0 Workarounds The exploit requires making a request against the Homarus's /convert endpoint; therefore, the ability to...

SUSE-SU-2025:0130-1 Security update for dnsmasq

This update for dnsmasq fixes the following issues: - Version update to 2.90: - CVE-2023-50387: Fixed a Denial Of Service while trying to validate specially crafted DNSSEC responses. bsc1219823 - CVE-2023-50868: Fixed a Denial Of Service while trying to validate specially crafted DNSSEC responses...

CVE-2024-54031

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsethash: unaligned atomic read on struct nftsetext Access to genmask field in struct nftsetext results in unaligned atomic read: 72.130109 Unable to handle kernel paging request at virtual address ffff0000c2bb708c...

CVE-2024-53681

In the Linux kernel, the following vulnerability has been resolved: nvmet: Don't overflow subsysnqn nvmetrootdiscoverynqnstore treats the subsysnqn string like a fixed size buffer, even though it is dynamically allocated to the size of the string. Create a new string with kstrndup instead of usin...