LlamaIndex has an XML Entity Expansion vulnerability in its sitemap parser

An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llamaindex repository, specifically affecting the Papers Loaders package before version 0.3.2 in llama-index v0.10.0 and above through v0.12.29. This vulnerability allows ...

WordPress CSS3 Compare Pricing Tables for WordPress plugin <= 11.6 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin CSS3 Compare Pricing Tables for WordPress versions = 11.6...

RHSA-2025:10378 Red Hat Security Advisory: tigervnc security update

Bulletin has no description...

RHSA-2025:10376 Red Hat Security Advisory: tigervnc security update

Bulletin has no description...

RHSA-2025:10375 Red Hat Security Advisory: tigervnc security update

Bulletin has no description...

RHSA-2025:10356 Red Hat Security Advisory: xorg-x11-server security update

Bulletin has no description...

RHSA-2025:10354 Red Hat Security Advisory: pam security update

Bulletin has no description...

RHSA-2025:10350 Red Hat Security Advisory: xorg-x11-server security update

Bulletin has no description...

RHSA-2025:10351 Red Hat Security Advisory: xorg-x11-server security update

Bulletin has no description...

RHSA-2025:10348 Red Hat Security Advisory: xorg-x11-server-Xwayland security update

Bulletin has no description...

RHSA-2025:10346 Red Hat Security Advisory: xorg-x11-server-Xwayland security update

Bulletin has no description...

RHSA-2025:10347 Red Hat Security Advisory: xorg-x11-server-Xwayland security update

Bulletin has no description...

RHSA-2025:10344 Red Hat Security Advisory: tigervnc security update

Bulletin has no description...

RHSA-2025:10343 Red Hat Security Advisory: xorg-x11-server security update

Bulletin has no description...

RHSA-2025:10342 Red Hat Security Advisory: xorg-x11-server security update

Bulletin has no description...

PT-2025-28216 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.3 Description: A Cross-Site Scripting XSS Injection issue was found in WeGIA, a web manager for charitable institutions. The vulnerability is located in the novo memorando.php file. When a memo is submitted, the...

PT-2025-28205 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.3 Description: A Reflected Cross-Site Scripting XSS issue was identified in the "cadastro dependente pessoa nova.php" endpoint of the WeGIA application. This issue allows attackers to inject malicious scripts in th...

PT-2025-28211

Name of the Vulnerable Software and Affected Versions LuaJIT versions through 2.1 Description LuaJIT is susceptible to a denial-of-service DoS condition due to an unsinking of IR FSTORE for a NULL metatable. Recommendations Update LuaJIT to a version later than 2.1...

PT-2025-28226 · Gnuboard5 · Gnuboard5

Name of the Vulnerable Software and Affected Versions: gnuboard5 version 5.5.16 Description: An open redirect issue allows a remote attacker to obtain sensitive information via the "bbs/login.php" component. Recommendations: For gnuboard5 version 5.5.16, update to a version that fixes this issue ...

PT-2025-28223 · Unknown · Better Auth

Name of the Vulnerable Software and Affected Versions: Better Auth versions prior to 1.2.10 Description: An open redirect issue has been found in the originCheck middleware function of Better Auth, an authentication and authorization library for TypeScript. The affected routes include...