CVE-2025-8109

Software installed and run as a non-privileged user may conduct ptrace system calls to issue writes to GPU origin read only memory...

HashiCorp Vault ldap auth method may not have correctly enforced MFA

Vault and Vault Enterprise’s “Vault” ldap auth method may not have correctly enforced MFA if usernameasalias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and...

Advisory ROSA-SA-2025-2945

software: curl 8.7.1 OS: ROSA-CHROME unaffected versions = curl-8.7.1-3 affected versions curl-8.7.1-3 CVE-ID: CVE-2025-0725 BDU-ID: 2025-01585 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the gzipdowrite function of the zlib compression library of the cURL command line utility is related to...

Advisory ROSA-SA-2025-2935

software: upx 5.0.0 WASP: ROSA-CHROME unaffected versions = upx-5.0.0.0-1 affected versions upx-5.0.0-1 CVE-ID: CVE-2025-2849 BDU-ID: 2025-06969 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the PackLinuxElf64::unDTINIT function of the src/plxelf.cpp file of the UPX executable file packer is...

Advisory ROSA-SA-2025-2926

software: yelp 42.2 WASP: ROSA-CHROME unaffected versions = yelp-42.2-2 affected versions yelp-42.2-2 CVE-ID: CVE-2025-3155 BDU-ID: 2025-03944 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Yelp help system is related to the inclusion of features from an invalid controlled scope when processing...

BELL-CVE-2025-54874

Bulletin has no description...

PT-2025-32207 · 4C Strategies · 4C Strategies Exonaut

Name of the Vulnerable Software and Affected Versions: 4C Strategies Exonaut versions prior to 21.6.2.1-1 Description: The software contains a Server-Side Request Forgery SSRF issue. SSRF occurs when a web application fetches a remote resource without validating the URL, potentially allowing an...

PT-2025-32205 · Unknown · Zone Bitaqati

Name of the Vulnerable Software and Affected Versions: Zone Bitaqati versions through 3.4.0 Description: A cross-site scripting XSS issue exists in Zone Bitaqati. Recommendations: Update Zone Bitaqati to a version later than 3.4.0...

PT-2025-32132

Name of the Vulnerable Software and Affected Versions versions prior to 2025-27066 Description The software experiences a temporary denial of service DoS when processing an ANQP message. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

CVE-2025-54801 Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in Decoder

Fiber is an Express inspired web framework written in Go. In versions 2.52.8 and below, when using Fiber's Ctx.BodyParser to parse form data containing a large numeric key that represents a slice index e.g., test.18446744073704, the application crashes due to an out-of-bounds slice allocation in...

GO-2025-3605 Vulnerable to Path Traversal via Crafted ZIP File in github.com/mholt/archiver

Vulnerable to Path Traversal via Crafted ZIP File in github.com/mholt/archiver...

Security Bulletin: IBM Tivoli Monitoring is affected by heap buffer overflow vulnerabilities

Summary IBM Tivoli Monitoring has addressed heap buffer overflow vulnerabilities CVE-2025-3354, CVE-2025-3320 Vulnerability Details CVEID:CVE-2025-3354 DESCRIPTION: IBM Tivoli Monitoring is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker could...

BIT-VAULT-2025-6000 Arbitrary Remote Code Execution via Plugin Catalog Abuse

A privileged Vault operator within the root namespace with write permission to sys/audit may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23...

BIT-VAULT-2025-5999 Vault Root Namespace Operator May Elevate Token Privileges

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy. Fixed in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11 and 1.16.22...

CVE-2025-8553 atjiu pybbs list cross site scripting

A vulnerability classified as problematic was found in atjiu pybbs up to 6.0.0. This vulnerability affects unknown code of the file /admin/sensitiveword/list. The manipulation of the argument word leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed ...

BELL-CVE-2025-54349

Bulletin has no description...

BELL-CVE-2025-54351

Bulletin has no description...

BELL-CVE-2024-13978

Bulletin has no description...

CVE-2025-54868 LibreChat exposes arbitrary chats through Meilisearch engine

LibreChat is a ChatGPT clone with additional features. In versions 0.0.6 through 0.7.7-rc1, an exposed testing endpoint allows reading arbitrary chats directly from the Meilisearch engine. The endpoint /api/search/test allows for direct access to stored chats in the Meilisearch engine without...

GHSA-3J6H-5V68-HVQG Liferay Portal CAPTCHA Bypass for Gogo Shell

The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP 2024.Q1.1 through 2024.Q1.19, 2024.Q2.0 through 2024.Q2.13, 2024.Q3.0 through 2024.Q3.13, 2024.Q4.0 through 2024.Q4.7, 2025.Q1.0 through 2025.Q1.15 and 7.4 update 80 through update 92 an...