K000157987: Multiple LibTIFF vulnerabilities

Security Advisory Description CVE-2022-0891 A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential...

CVE-2025-11461

CVE-2025-11461 affects Frappe CRM 1.53.1. The vulnerability is multiple SQL injections in the Dashboard Controller caused by unsafe concatenation of user-controlled parameters into dynamic SQL statements. Red Hat and EUVD entries confirm the same description. Connected documents do not specify a ...

lw-cnapp-microservices-iac

Project 2: Microservices with Infrastructure as Code ⚠️ WAR...

CVE-2025-36149

IBM Concert Software 1.0.0 through 2.0.0 could allow a remote attacker to hijack the clicking action of the victim...

CVE-2025-62294

SOPlanning is vulnerable to Predictable Generation of Password Recovery Token. Due to weak mechanism of generating recovery tokens, a malicious attacker is able to brute-force all possible values and takeover any account in reasonable amount of time. This issue was fixed in version 1.55...

CVE-2025-62354

Improper neutralization of special elements used in an OS command 'command injection' in Cursor allows an unauthorized attacker to execute commands that are outside of those specified in the allowlist, resulting in arbitrary code execution...

📄 XWiki Platform 15.10.10 Remote Command Execution

XWiki Platform version 15.10.10 suffers from a critical unauthenticated remote command execution vulnerability through the SolrSearch endpoint. The issue is patched in versions 15.10.11, 16.4.1, and 16.5.0RC1...

SUSE: Security Advisory (SUSE-SU-2025:4174-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-56396

An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department having higher rights than the active user...

Microsoft Windows Extended Security Updates (ESU) Status Detection

SMB login-based detection of the Microsoft Windows Extended Security Updates ESU status. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Mastering Software Governance with Hosted Technologies Inventory

Gain visibility into every technology in your environment and eliminate governance gaps...

CISA Releases Seven Industrial Control Systems Advisories

CISA released seven Industrial Control Systems ICS Advisories. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-329-01 Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share ICSA-25-329-02 Rockwell Automation Aren...

CVE-2025-62372

vLLM is an inference and serving engine for large language models LLMs. From version 0.5.5 to before 0.11.1, users can crash the vLLM engine serving multimodal models by passing multimodal embedding inputs with correct ndim but incorrect shape e.g. hidden dimension is wrong, regardless of whether...

BELL-CVE-2025-40213

Bulletin has no description...

Malicious code in @accordproject/concerto-linter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a266ef73fe4cd4e7227a57de2c97b342daf2ae0aed81e06b41bd9a55ab02d24 The package @accordproject/concerto-linter was found to contain malicious code. Source: ghsa-malware...

PT-2025-48031

Name of the Vulnerable Software and Affected Versions mJobtime version 15.7.2 Description The software handles authorization on the client side, allowing an attacker to modify the client-side code and gain access to administrative features. Attackers can craft requests based on the modified...

Photon OS 4.0: Linux PHSA-2025-4.0-0913

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-4.0-0913. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

TOR Virtual Network Tunneling Tool 0.4.8.21

Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow...

Hcl Inotes 安全漏洞

HCL Hcl Inotes is a software from HCL India that allows management of IBMDomino emails, scheduling of errands and other office activity management. A security vulnerability exists in Hcl Inotes that stems from improper validation of user input and could lead to a reflective cross-site scripting...

Security Bulletin: NVIDIA NeMo Agent Toolkit - November 2025

NVIDIA has released a software update for NVIDIA® NeMo Agent Toolkit. To protect your system, clone or update this software to version 1.3.0 or later from NVIDIA GitHub. The affected sub-module is https://github.com/NVIDIA/NeMo-Agent-Toolkit-UI. Go to NVIDIA Product Security. To protect your...