BELL-CVE-2025-5278

Bulletin has no description...

PT-2025-23097 · Dell · Dell Powerstore

Name of the Vulnerable Software and Affected Versions: Dell PowerStore version 4.0.0.0 Description: The issue concerns the use of hard-coded credentials in the PowerStore image file. A low-privileged attacker with remote access and knowledge of these credentials could exploit this to gain...

PT-2025-23106

Name of the Vulnerable Software and Affected Versions Kea versions 2.4.0 through 2.4.1 Kea versions 2.6.0 through 2.6.2 Kea versions 2.7.0 through 2.7.8 Description In some cases, Kea log files or lease files may be world-readable. Recommendations For Kea versions 2.4.0 through 2.4.1, update to a...

PT-2025-23224 · Vllm · Vllm

Name of the Vulnerable Software and Affected Versions: vLLM versions 0.6.4 through 0.9.0 Description: The issue is a Regular Expression Denial of Service ReDoS vulnerability in the file vllm/entrypoints/openai/tool parsers/pythonic tool parser.py. The root cause is the use of a highly complex and...

PT-2025-23135 · Vllm · Vllm

Name of the Vulnerable Software and Affected Versions: vLLM versions prior to 0.9.0 Description: The issue arises from the prefix caching mechanism in vLLM, which may expose the system to a timing side-channel attack. When a new prompt is processed, if the PageAttention mechanism finds a matching...

CVE-2025-30087

Best Practical RT Request Tracker 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL...

CVE-2025-31500

Best Practical RT Request Tracker 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name...

GO-2025-3707 OpenFGA Authorization Bypass in github.com/openfga/openfga

OpenFGA Authorization Bypass in github.com/openfga/openfga...

CVE-2025-48797 Gimp: multiple heap buffer overflows in tga parser

A flaw was found in GIMP when processing certain TGA image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing a heap buffer overflow...

CVE-2025-5268

Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox...

Out-of-Bounds-Read

libassimp.so is vulnerable to an out-of-bounds read. The vulnerability is due to improper bounds checking due to inadequate validation in the MDLImporter::InternReadFile3DGSMDL345 function of MDLLoader.cpp, which allows a local attacker to read data outside the intended memory bounds...

MAL-2025-4502 Malicious code in skinnyvans (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b4d7d1afb0bbd6fed02c341b71eba019f92f582433d971e6538b5693d9d026e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-26211

Gibbon before 29.0.00 allows CSRF...

CVE-2025-48054 Radashi Vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Radashi is a TypeScript utility toolkit. Prior to version 12.5.1, the set function within the Radashi library is vulnerable to prototype pollution. If an attacker can control parts of the path argument to the set function, they could potentially modify the prototype of all objects in the JavaScri...

WordPress Essential Blocks plugin <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider and Post Carousel Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Slider and Post Carousel Widgets vulnerability discovered by Webbernaut in WordPress Plugin Essential Blocks for Gutenberg versions = 5.4.0...

PT-2025-23005 · Opentext · Opentext Advance Authentication

Name of the Vulnerable Software and Affected Versions: OpenText Advanced Authentication versions prior to 6.5 Description: The issue allows exposure of sensitive system information to an unauthorized control sphere, potentially revealing sensitive information during the management and configurati...

CVE-2025-26211

Gibbon before 29.0.00 allows CSRF...

CVE-2025-46803

The default mode of pseudo terminals PTYs allocated by Screen was changed from 0620 to 0622, thereby allowing anyone to write to any Screen PTYs in the system...

CVE-2025-4057 Activemq-artemis-operator: amq broker operator starting credentials reuse

A flaw was found in ActiveMQ Artemis. The password generated by activemq-artemis-operator does not regenerate between separated CR dependencies...

BIT-GITLAB-2025-0993 Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. This could allow an authenticated attacker to cause a denial of service condition by exhausting server resources...