BIT-MODSECURITY-2025-54571 ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrate...

CVE-2025-54876

The Janssen Project is an open-source identity and access management IAM platform. In versions 1.9.0 and below, Janssen stores passwords in plaintext in the local clicmd.log file. This is fixed in the nightly prerelease...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: xsk: Fix race condition in AFXDP generic RX path CVE-2025-37920 In the Linux kernel, the following vulnerability has been resolved: virtio: break and reset virtio devices on deviceshutdown CVE-2025-38064 In the...

CVE-2025-54124

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 9.8-rc-1 through 16.4.6, 16.5.0-rc-1 through 16.10.4, and 17.0.0-rc-1 through 17.1.0, any user with editing rights can creat...

CVE-2025-51533

An Insecure Direct Object Reference IDOR in Sage DPW v202412004 and below allows unauthorized attackers to access internal forms via sending a crafted GET request...

CLSA-2025-1754554806 libxml2: Fix of CVE-2025-7425

CVE-2025-7425: fix heap-use-after-free in xmlFreeID caused by atype corruption...

CLSA-2025-1754552473 libxml2: Fix of CVE-2025-7425

CVE-2025-7425: fix heap-use-after-free in xmlFreeID caused by atype corruption...

crypto: algif_hash - fix double free in hash_accept

...

fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var

...

atm: Revert atm_account_tx() if copy_from_iter_full() fails.

...

ksmbd: fix null pointer dereference in destroy_previous_session

...

Security Bulletin: Vulnerabilities in Babel affects IBM watsonx Orchestrate with watsonx Assistant Cartridge

Summary Potential vulnerability in Babel has been identified that affects IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component. The vulnerability has been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2025-27789 DESCRIPTION: Babel is a...

CVE-2025-54882

CVE-2025-54882 affects Himmelblau, an interoperability suite for Microsoft Azure Entra ID and Intune. From the public records, versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0 store the cloud TGT during logon in the Kerberos credential cache, and the created credential cache collection ...

CVE-2025-54882 Himmelblau's Kerberos credential cache collection is world readable

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himmelblau stores the cloud TGT received during logon in the Kerberos credential cache. The created credential cache collection and received credentials...

Linux Distros Unpatched Vulnerability : CVE-2025-21941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/display: Fix null check for pipectx-planestate in resourcebuildscalingparams Null pointer dereference issue could occur when pipectx-planestate is null...

CVE-2025-51533

An Insecure Direct Object Reference IDOR in Sage DPW v202412004 and below allows unauthorized attackers to access internal forms via sending a crafted GET request...

quiche -- Infinite loop triggered by connection ID retirement

Quiche Releases reports: This update includes 1 security fix: High CVE-2025-7054: Infinite loop triggered by connection ID retirement. Reported by Catena cyber on 2025-08-07...

Moderate: libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: The libxml2 library is a development toolbox providing the implementation of...

CVE-2025-48394

An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI. This security issue has been fixed in the latest version which is available on the Eaton download center...

GHSA-7RX2-769V-HRWF HashiCorp Vault ldap auth method may not have correctly enforced MFA

Vault and Vault Enterprise’s “Vault” ldap auth method may not have correctly enforced MFA if usernameasalias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and...