DSA-5893-1 tomcat10 - security update

Bulletin has no description...

PT-2025-22633 · Git +1 · Archive

Name of the Vulnerable Software and Affected Versions: KArchive affected versions not specified Description: The software suffers from a global-buffer-overflow read issue. The crash occurs during the parseExtraField function, within the KZip::openArchive and KArchive::open functions...

CVE-2025-0468

Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kern...

CVE-2025-32262

Technical details about CVE-2025-32262 are not provided in the supplied documents. The description notes a CSRF in RDP Wiki Embed (up to version 1.2.20) but lacks specifics on affected versions, impact, exploitability, or fixes.

CVE-2025-25178

CVE-2025-25178 affects Imagination Technologies’ GPU driver (PowerVR-GPU) where an unprivileged user can trigger improper GPU system calls, leading to kernel memory corruption. The CVE is described as a GPU-driver memory corruption risk from local, low-privilege execution with no user interaction...

CVE-2025-0468

CVE-2025-0468 describes a vulnerability in Imagination Technologies/GPU driver where a non-privileged user can issue improper GPU system calls to subvert GPU hardware, potentially writing to arbitrary physical memory pages. The affected component is the GPU driver stack (PowerVR/GPU DDK lineage) ...

CVE-2025-27520 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest version v1.4.2 of BentoML. It allows any unauthenticated user to execute...

WordPress Table Block by RioVizual plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Mika in WordPress Plugin Table Block by RioVizual versions = 2.3.1...

WordPress Revive.so plugin <= 2.0.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by theviper17 in WordPress Plugin Revive.so versions = 2.0.3...

WordPress WP Event Manager plugin <= 3.2.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin WP Event Manager versions = 3.2.0...

WordPress Ai Image Alt Text Generator for WP plugin <= 1.1.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Thaleikis in WordPress Plugin Ai Image Alt Text Generator for WP versions = 1.1.1...

Improper Access Control

org.opendaylight.sfc:sfc-parent is vulnerable to Improper Access Control. The vulnerability is due to flaws in the Shiro-based RBAC mechanism due to improper enforcement of role-based access control, allowing attackers to execute privileged operations via crafted requests...

PT-2025-15007 · WordPress · Jetpack Feedback Exporter

Name of the Vulnerable Software and Affected Versions: Jetpack Feedback Exporter versions 1.23 and earlier Description: The issue allows exposure of sensitive system information to an unauthorized control sphere, enabling the retrieval of embedded sensitive data. Recommendations: For Jetpack...

PT-2025-14906 · Imagination Technologies · Graphics Ddk

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstances, this...

PT-2025-15024 · Unknown · Broadstreet

Name of the Vulnerable Software and Affected Versions: Broadstreet versions 1.51.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For versions 1.51.1 and earlier,...

PT-2025-14978 · Unknown · Blazethemes News Kit Elementor Addons

Name of the Vulnerable Software and Affected Versions: blazethemes News Kit Elementor Addons versions 1.3.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

PT-2025-14943 · Unknown · Jakub Glos Sparkle Elementor Kit

Name of the Vulnerable Software and Affected Versions: Jakub Glos Sparkle Elementor Kit versions 2.0.9 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local...

PT-2025-23641 · Sangoma · Sangoma Img2020

Name of the Vulnerable Software and Affected Versions: Sangoma IMG2020 versions through 2.3.9.6 Description: The issue is related to a buffer overflow in the HTTP server of the Sangoma IMG2020, which can allow an unauthenticated user to achieve remote code execution. This can be exploited by a...

PT-2025-14965 · Unknown · Galaxy Weblinks Video Playlist For Youtube

Name of the Vulnerable Software and Affected Versions: Galaxy Weblinks Video Playlist For YouTube versions through 6.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

PT-2025-14839 · Unknown · Spatie/Browsershot

Name of the Vulnerable Software and Affected Versions: spatie/browsershot versions 0.0.0 through 3.1 Description: The issue is related to Server-side Request Forgery SSRF in the setUrl function due to a missing restriction on user input. This enables attackers to access localhost and list all of...