CVE-2025-23046 GLPI vulnerable to unauthorized authentication by email using the OAuthIMAP plugin

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a "Mail servers" authentication provider is configured to use an Oauth connection provided by the OauthIMAP plugin, anyone can connect to GLPI using a user name on which an Oauth...

CVE-2025-26595 Xorg: xwayland: buffer overflow in xkbvmodmasktext()

A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size...

CVE-2025-26594 X.org: xwayland: use-after-free of the root cursor

A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free...

GHSA-HJWW-XJQ7-7798 vulnerabilities

Vulnerabilities for packages: openjdk-8-openj9, openjdk-21-openj9, openjdk-17-openj9, openjdk-25-openj9, openjdk-26-openj9, openjdk-11-openj9...

BELL-CVE-2025-0838

Bulletin has no description...

PT-2025-8665

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description An issue exists where an attacker can pass a malicious malformed token, causing unexpected memory consumption during parsing. Recommendations At the moment, there is no information about a new...

CVE-2025-25208

No description is available for this CVE...

CVE-2025-26531

Insufficient capability checks made it possible to disable badges a user does not have permission to access...

CVE-2025-26533

An SQL injection risk was identified in the module list filter within course search...

CVE-2025-26530

The question bank filter required additional sanitizing to prevent a reflected XSS risk...

Moodle allows reflected XSS via question bank filter

The question bank filter required additional sanitizing to prevent a reflected XSS risk...

CVE-2025-1594

A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ffaacsearchfortns of the file libavcodec/aacenctns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The...

Phusion Passenger denial of service

The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method...

CVE-2025-1632

A flaw was found in the bsdunzip utility of libarchive. In affected versions, a specially crafted file may trigger a null pointer dereference. This issue can lead to an application crash or other unexpected behavior...

Advisory ROSA-SA-2025-2716

Software: perl 5.26.3 OS: ROSA Virtualization 3.0 packageevrstring: perl-5.26.3 CVE-ID: CVE-2020-10878 BDU-ID: 2020-04040 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the PLregkindOPn == NOTHING parameter of the Perl programming language interpreter is related to integer overflow. Exploitation of...

Mattermost allows reading arbitrary files

Mattermost versions 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to properly validate input when patching and duplicating a board, which allows a user to read any arbitrary file on the system via duplicating a specially crafted block in Boards...

CVE-2025-25460

A stored Cross-Site Scripting XSS vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature. This vulnerability allows authenticated attackers to inject malicious JavaScript payloads into blog posts, which are executed when other users view the posts. The issue arises due to...

Phusion Passenger denial of service

The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method...

CVE-2025-27106

binance-trading-bot is an automated Binance trading bot with trailing buy/sell strategy. Authenticated users of binance-trading-bot can achieve Remote Code Execution on the host system due to a command injection vulnerability in the /restore endpoint. The restore endpoint of binance-trading-bot i...

MAL-2025-1519 Malicious code in erc20-faucet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1318f067a3c4a722bc3d70af3c94d47696dc695c07dafc5cac772db0e1b20fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...