CVE-2025-55317

CVE-2025-55317 concerns Microsoft AutoUpdate (MAU) and its elevation of privilege via improper link resolution before file access ("link following"). Affected: MAU components on macOS; vulnerability allows an authorized local attacker to escalate privileges. Root cause: improper link resolution b...

Advisory ROSA-SA-2025-2983

software: qt6-qtbase 6.8.3 OS: ROSA-CHROME unaffected versions = qt6-qtbase-6.8.3-3 affected versions qt6-qtbase-6.8.3-3 CVE-ID: CVE-2025-5455 BDU-ID: 2025-06498 CVE-Crit: CRITICAL CVE-DESC.: A vulnerability in the qDecodeDataUrl function of the QtCore module of the QtCore cross-platform software...

PT-2025-36567

Name of the Vulnerable Software and Affected Versions: Tautulli versions prior to 2.16.0 Description: Tautulli is a Python-based monitoring and tracking tool for Plex Media Server. The /image API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files...

MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server

An XSS flaw exists in the MCP Inspector local development tool when it renders a redirect URL returned by a remote MCP server. If the Inspector connects to an untrusted server, a crafted redirect can inject script into the Inspector context and, via the built-in proxy, be leveraged to trigger...

RHSA-2025:15436 Red Hat Security Advisory: thunderbird security update

Bulletin has no description...

JVN#75307484: RICOH Streamline NX vulnerable to tampering with operation history

RICOH Streamline NX provided by Ricoh Company, Ltd. contains the following vulnerability. Use of Less Trusted Source CWE-348 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Base Score 2.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N Base Score 3.1 CVE-2025-58422 Impact If an...

PT-2025-36620

An XSS issue was reported in the MCP Inspector local development tool when connecting to an untrusted remote MCP server with a malicious redirect URI. This could be leveraged to interact directly with the inspector proxy to trigger arbitrary command execution. Users are advised to update to 0.16....

HPESBNW04767 rev.1 - HPE Intelligent Assurance Using Apache, Multiple Vulnerabilities

Potential Security Impact: Remote: Code Execution, Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Intelligent Assurance - Prior to v4.2.7 - HPE Telco INT-A FAS and PDO CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2024-47554 |...

Obsidian GitHub Copilot Plugin stores sensitive information in cleartext

Overview Obsidian GitHub Copilot Plugin provided by Pierre-Adrien Vasseur is vulnerable to the following vulnerability. Cleartext storage of sensitive information CWE-312 - CVE-2025-58401 Rui Nakajima reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...

CVE-2025-30277

An improper certificate validation vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync Central...

openSUSE Security Advisory (SUSE-SU-2025:02990-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

TencentOS Server 4: openjpeg2 (TSSA-2025:0700)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0700 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Security Bulletin: NVIDIA NeMo Curator - August 2025

NVIDIA has released a software update for NVIDIA® NeMo Curator To protect your system, download and install the latest NVIDIA Nemo Curator from NVIDIA Github. Go to NVIDIA Product Security...

Photon OS 4.0: Openjdk21 PHSA-2025-4.0-0860

An update of the openjdk21 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-4.0-0860. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

DLA-4283-1 luajit - security update

Bulletin has no description...

Fedora 41 : rust-slab (2025-92719fd556)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-92719fd556 advisory. Update to version 0.4.11. This version includes a fix for CVE-2025-55159, but there are zero packages in Fedora or EPEL that use the affected API, so no...

DLA-4279-1 thunderbird - security update

Bulletin has no description...

Western Digital Kitfox registers a Windows service with an unquoted file path

Overview Western Digital Kitfox for Windows provided by Western Digital Corporation contains the following vulnerability. Unquoted search path or element CWE-428 - CVE-2025-57699 Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with th...

PT-2025-34380 · D Link · D-Link Dir-619L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L version 2.06B01 Description: The D-Link DIR-619L device is susceptible to a buffer overflow in the formWlanSetup function through the f wds wepKey parameter. Recommendations: Update to a newer version that contains a fix for...

JVN#75211379: Western Digital Kitfox registers a Windows service with an unquoted file path

Western Digital Kitfox for Windows provided by Western Digital Corporation contains the following vulnerability. Unquoted search path or element CWE-428 CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.4 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 6.7...