Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in Mongoose

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of Mongoose Vulnerability Details CVEID:CVE-2025-23061 DESCRIPTION: Mongoose before 8.9.5 can improperly use a nested $where filter with a populate match, leading to search injection. NOTE: this issue exists because of an...

RHSA-2025:4513 Red Hat Security Advisory: thunderbird security update

Bulletin has no description...

RHSA-2025:4499 Red Hat Security Advisory: kpatch-patch-5_14_0-503_15_1 and kpatch-patch-5_14_0-503_26_1 security update

Bulletin has no description...

RHSA-2025:4462 Red Hat Security Advisory: osbuild-composer security update

Bulletin has no description...

PT-2025-19991 · Crestron · Crestron Automate Vx

Name of the Vulnerable Software and Affected Versions: Crestron Automate VX versions 5.6.8161.21536 through 6.4.0.49 Description: The issue allows privilege escalation. It affects Crestron Automate VX, with no specific details on the number of potentially affected devices or real-world incidents...

PT-2025-19984 · Zitadel · Zitadel

Name of the Vulnerable Software and Affected Versions: ZITADEL versions prior to 3.0.0 ZITADEL versions prior to 2.71.9 ZITADEL versions prior to 2.70.10 Description: The issue concerns the Session API in ZITADEL, which allows developers to manage user sessions and use IdPs for authentication...

PT-2025-19959 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS version 13.3 Description: A SQL injection issue was discovered in the admin comment news.php component. Recommendations: For SeaCMS version 13.3, update to a version that fixes the SQL injection vulnerability in the admin comment...

PT-2025-19997 · Brightsign · Brightsign Os Series 4 +1

Name of the Vulnerable Software and Affected Versions: BrightSign OS series 4 versions prior to 8.5.53.1 BrightSign OS series 5 versions prior to 9.0.166 Description: The issue allows for privilege escalation on the device once code execution has been obtained, due to execution with unnecessary...

PT-2025-19958

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.0 through 7.4.3.131 Liferay DXP versions 2024.Q1.1 through 2024.Q4.5 Description A reflected cross-site scripting XSS issue exists in Liferay Portal and DXP. This allows a remote, unauthenticated attacker to inject...

PT-2025-19970 · Unknown · Passport-Wsfed-Saml2

Name of the Vulnerable Software and Affected Versions: passport-wsfed-saml2 versions 3.0.5 through 4.6.3 Description: A vulnerability in passport-wsfed-saml2 allows an attacker to impersonate any user during SAML authentication by tampering with a valid SAML response. This can be done by adding...

CBL Mariner 2.0 Security Update: kernel (CVE-2025-21731)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21731 advisory. - In the Linux kernel, the following vulnerability has been resolved: nbd: don't allow reconnect after...

PT-2025-19832 · WordPress · Layoutboxx

Name of the Vulnerable Software and Affected Versions: LayoutBoxx plugin for WordPress versions up to and including 0.3.1 Description: The issue allows unauthenticated attackers to execute arbitrary shortcodes due to the software not properly validating a value before running do shortcode. This...

PT-2025-19895 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 5.0.3 Description: The issue allows a local attacker to cause a denial of service DOS through a NULL pointer dereference. Recommendations: For versions prior to 5.0.3, update to a version that contains a fix for...

CBL Mariner 2.0 Security Update: kernel (CVE-2025-21683)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21683 advisory. - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpfskselectreuseport memory lea...

Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI

Craft CMS contains a potential remote code execution vulnerability via Twig SSTI. You must have administrator access and ALLOWADMINCHANGES must be enabled for this to work. https://craftcms.com/knowledge-base/securing-craftset-allowAdminChanges-to-false-in-production Note: This is a follow-up to...

CVE-2025-24977 OpenCTI has remote code execution and sensitive secrets exposed through web hook

OpenCTI is an open cyber threat intelligence CTI platform. Prior to version 6.4.11 any user with the capability manage customizations can execute commands on the underlying infrastructure where OpenCTI is hosted and can access internal server side secrets by misusing the web-hooks. Since the...

RHSA-2025:4451 Red Hat Security Advisory: yelp security update

Bulletin has no description...

RHSA-2025:4447 Red Hat Security Advisory: xmlrpc-c security update

Bulletin has no description...

RHSA-2025:4439 Red Hat Security Advisory: libsoup security update

Bulletin has no description...

PT-2025-19707 · Outsystems · Outsystems

Name of the Vulnerable Software and Affected Versions: Outsystems versions prior to 3.1.0 Description: The issue arises because file extension and size validations are enforced solely on the client side in the Outsystems Multiple File Upload feature. This allows an attacker to intercept the uploa...