BIT-MODSECURITY2-2025-52891 ModSecurity empty XML tag causes segmentation fault

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least...

BIT-LIMESURVEY-2024-42901

A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file...

BELL-CVE-2025-38105

Bulletin has no description...

BELL-CVE-2025-38147

Bulletin has no description...

Cockpit - Content Platform vulnerable to XSS through name or email argument names

A vulnerability was found in Cockpit versions up to 2.11.3. This issue affects some unknown processing instances of the file /system/users/save. The manipulation of the arguments "name" or "email" leads to cross-site scripting. The attack may be initiated remotely. Upgrading to version 2.11.4 wil...

CVE-2025-49601

In MbedTLS 3.3.0 before 3.6.4, mbedtlslmsimportpublickey does not check that the input buffer is at least 4 bytes before reading a 32-bit field, allowing a possible out-of-bounds read on truncated input. Specifically, an out-of-bounds read in mbedtlslmsimportpublickey allows context-dependent...

Next.JS vulnerability can lead to DoS via cache poisoning

Summary A vulnerability affecting Next.js has been addressed. It impacted versions 15.0.4 through 15.1.8 and involved a cache poisoning bug leading to a Denial of Service DoS condition. Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to th...

BELL-CVE-2025-38161

Bulletin has no description...

BELL-CVE-2025-38159

Bulletin has no description...

BELL-CVE-2025-38136

Bulletin has no description...

BELL-CVE-2025-38131

Bulletin has no description...

BELL-CVE-2025-38097

Bulletin has no description...

BELL-CVE-2025-38127

Bulletin has no description...

BELL-CVE-2025-38113

Bulletin has no description...

BELL-CVE-2025-38096

Bulletin has no description...

RHSA-2025:10196 Red Hat Security Advisory: thunderbird security update

Bulletin has no description...

CVE-2025-38098 drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Don't treat wb connector as physical in createvalidatestreamforsink Don't try to operate on a drmwbconnector as an amdgpudmconnector. While dereferencing aconnector-base will "work" it's wrong and might lead to...

MINI-R6W5-99W8-4XJ5

Bulletin has no description...

MINI-H83M-C5MV-52QR

Bulletin has no description...

MAL-2025-5598 Malicious code in @stihlus/stihl-icons-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b7a2eeaded2a276a85d303add7611ab4f65579f9d08c53712a84d46c304003d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...