Security update for dpkg

This update for dpkg fixes the following issues: CVE-2025-6297: Fixed an improper sanitization of directory permissions that could lead to DoS. bsc1245573 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

CVE-2025-51532

Incorrect access control in Sage DPW 202412004 and earlier allows unauthorized attackers to access the built-in Database Monitor via a crafted request. The vendor has stated that the issue is fixed in 202506000, released in June 2025...

Important Photon OS Security Update - PHSA-2025-4.0-0848

Updates of 'libtiff' packages of Photon OS have been released...

PT-2026-23870

Name of the Vulnerable Software and Affected Versions Netmaker versions prior to 1.5.0 Description Netmaker, which utilizes WireGuard, has an issue where the user update handler does not properly validate role assignments. Specifically, an administrator-role user can assign the super-admin role t...

PT-2026-23868

Name of the Vulnerable Software and Affected Versions Netmaker versions prior to 1.5.0 Description Netmaker, which utilizes WireGuard, has an issue where the Authorize middleware does not properly validate host JWT tokens. When host authentication is permitted hostAllowed=true, a valid host token...

PT-2026-23871

Name of the Vulnerable Software and Affected Versions Netmaker versions prior to 1.5.0 Description Netmaker, a networking tool utilizing WireGuard, contains an issue where a user with the platform-user role can access WireGuard private keys for all configurations within a network. This occurs...

CVE-2025-32430

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-3 through 16.4.7, 16.5.0-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, two templates contain reflected XSS vulnerabilities, allowing an attacker to execute...

CVE-2025-38430 affecting package kernel for versions less than 6.6.96.1-1

CVE-2025-38430 affecting package kernel for versions less than 6.6.96.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-49180 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-2

CVE-2025-49180 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-2. A patched version of the package is available...

CVE-2025-49179 affecting package xorg-x11-server for versions less than 1.20.10-16

CVE-2025-49179 affecting package xorg-x11-server for versions less than 1.20.10-16. A patched version of the package is available...

CVE-2025-5455 affecting package qt5-qtbase for versions less than 5.12.11-18

CVE-2025-5455 affecting package qt5-qtbase for versions less than 5.12.11-18. A patched version of the package is available...

Security update for grub2

This update for grub2 fixes the following issues: CVE-2024-56738: Fixed side-channel attack due to not constant-time algorithm in grubcryptomemcmp bsc1234959 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

CVE-2025-5061

The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpieparseuploaddata' function in all versions up to, and including, 3.9.29. This makes it possible for authenticated attackers, with Subscriber-level access and above...

ACPICA: fix acpi parse and parseext cache leaks

...

s390/pkey: Prevent overflow in size calculation for memdup_user()

...

CVE-2025-8548

A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function sendEmailCode of the file src/main/java/co/yiiu/pybbs/controller/api/SettingsApiController.java of the component Registered Email Handler. The manipulation of the argument email lea...

CVE-2025-54387

IPX is an image optimizer powered by sharp and svgo. In versions 1.3.1 and below, 2.0.0-0 through 2.1.0, and 3.0.0 through 3.1.0, the approach used to check whether a path is within allowed directories is vulnerable to path prefix bypass when the allowed directories do not end with a path...

CVE-2025-54784

SuiteCRM 7.14.0–7.14.6 contains a Cross Site Scripting (XSS) vulnerability in the email viewer. An attacker can trigger payloads by a logged-in user simply viewing emails, potentially allowing arbitrary actions, data extraction, or takeover if the user is an admin. A fix is available in version 7...

CVE-2025-54783

CVE-2025-54783 affects SuiteCRM up to version 7.14.6, with a reflected XSS vulnerability triggered by modifying the HTTP Referer header to inject JavaScript. The server may block the domain but still execute the injected script. Remediation is to upgrade to SuiteCRM 7.14.7 or later. No exploitati...

Linux Distros Unpatched Vulnerability : CVE-2024-57877

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: fix partial SETREGSET for NTARMPOE Currently poeset doesn't initialize the...