CVE-2025-6297 dpkg-deb: Fix cleanup for control member with restricted directories

It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and...

CVE-2025-6297

The CVE-2025-6297 issue affects the dpkg-deb component, where improper sanitization of directory permissions when extracting a control member into a temporary directory can leave temporary files and lead to DoS via disk quota exhaustion or full disks. Affected: dpkg- and debian-based tooling acro...

Security update for screen

This update for screen fixes the following issues: Security issues fixed: CVE-2025-46802: temporary chmod of a user's TTY to mode 0666 when attempting to attach to a multi-user session allows for TTY hijacking bsc1242269. Other issues fixed: Use TTY file descriptor passing after a suspend MSGCONT...

SUSE-SU-2025:02186-1 Security update for screen

This update for screen fixes the following issues: Security issues fixed: - CVE-2025-46802: temporary chmod of a user's TTY to mode 0666 when attempting to attach to a multi-user session allows for TTY hijacking bsc1242269. Other issues fixed: - Use TTY file descriptor passing after a suspend...

PT-2025-27556 · Unknown · Campcodes Employee Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Employee Management System version 1.0 Description: A critical issue was found in the system, affecting an unknown functionality of the file /empproject.php. The manipulation of the ID argument leads to SQL injection. The attack can...

PT-2025-27533 · Unknown · Campcodes Employee Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Employee Management System version 1.0 Description: A critical issue was found in Campcodes Employee Management System, affecting an unknown part of the file /changepassemp.php. The manipulation of the ID argument leads to SQL...

Fedora 42 : udisks2 (2025-6ef0c40f95)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-6ef0c40f95 advisory. Harden temporary private mounts 2373301 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus ha...

PT-2025-27548 · Unknown · Campcodes Employee Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Employee Management System version 1.0 Description: A critical issue has been discovered, affecting the file /process/eprocess.php, where the manipulation of the mailuid argument leads to SQL injection. This issue can be exploited...

PT-2025-27569 · Ullu · Ullu

Name of the Vulnerable Software and Affected Versions: Ullu versions 2.9.929 Android and 2.8.0 IOS Description: The issue is related to incorrect access control, allowing attackers to bypass the parental pin feature via unspecified vectors. Recommendations: For Ullu version 2.9.929 Android and...

PT-2025-27404 · Unknown · Phpgurukul Teachers Record Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Teachers Record Management System version 2.1 Description: A critical issue was found in the system, affecting an unknown function of the file /admin/edit-teacher-detail.php. The manipulation of the tid argument leads to SQL...

PT-2025-27455 · Unknown · String-Math

Name of the Vulnerable Software and Affected Versions: string-math version 1.2.2 Description: The issue is a Regex Denial of Service ReDoS that can be exploited via a crafted input. Recommendations: For string-math version 1.2.2, consider validating and sanitizing all inputs to prevent crafted...

PT-2025-27481 · Unknown · Phpgurukul Zoo Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Zoo Management System version 2.1 Description: A critical issue has been discovered, affecting an unknown function of the file /admin/manage-foreigners-ticket.php. The manipulation of the ID argument leads to SQL injection. This...

Insecure Temporary File Handling Vulnerability in llama-index-core

Description The getcachedir function in llama-index-core uses a predictable, hardcoded directory path /tmp/llamaindex on Linux systems without proper security controls. This vulnerability allows attackers on multi-user systems to steal proprietary models, poison cached embeddings, or conduct...

Directory Traversal

Overview langchain-chatchat is a Langchain-Chatchat formerly langchain-ChatGLM, local knowledge based LLM like ChatGLM, Qwen and Llama RAG and Agent app with langchain Affected versions of this package are vulnerable to Directory Traversal via the parsefile function in the...

PT-2025-27380

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Company Website version 1.0 Description: A critical issue was found in the software, affecting an unknown functionality of the file /admin/testimonials/manage.php. The manipulation of the ID argument leads to SQL...

PT-2025-27357

Name of the Vulnerable Software and Affected Versions: HDF5 version 1.14.6 Description: A problematic issue was found in the function H5FL reg gc list of the file src/H5FL.c. The manipulation leads to use after free. Attacking locally is a requirement. Recommendations: For HDF5 version 1.14.6, as...

PT-2025-27360

Name of the Vulnerable Software and Affected Versions: HDF5 version 1.14.6 Description: A null pointer dereference issue was found in the function H5C flush single entry of the file src/H5Centry.c. The manipulation leads to this issue, and the attack needs to be approached locally. Recommendation...

PT-2025-27382 · Unknown · Sourcecodester Simple Company Website

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Company Website version 1.0 Description: A critical issue has been discovered, affecting an unknown part of the file /classes/Login.php. The manipulation of the Username argument leads to SQL injection. This issue can be...

PT-2025-27333 · Unknown · Aaluoxiang Oa System

Name of the Vulnerable Software and Affected Versions: aaluoxiang oa system up to c3a08168c144f27256a90838492c713f55f1b207 Description: A critical issue was found in the outAddress function of the External Address Book Handler component, leading to SQL injection. The attack can be initiated...

PT-2025-27318

Name of the Vulnerable Software and Affected Versions: HDF5 version 1.14.6 Description: A heap-based buffer overflow issue was found in the function H5O chunk protect of the file /src/H5Ochunk.c. This issue can be exploited locally. Recommendations: For HDF5 version 1.14.6, as a temporary...