CVE-2025-4948 affecting package libsoup for versions less than 3.4.4-8

CVE-2025-4948 affecting package libsoup for versions less than 3.4.4-8. A patched version of the package is available...

CVE-2025-53514

Mattermost Confluence Plugin version 1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to server webhook endpoint with an invalid request body...

WordPress Gravity Forms Plugin < 1.9.7 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mediaburst:gravityforms"; if description...

CVE-2025-38346 affecting package kernel for versions less than 6.6.96.1-1

CVE-2025-38346 affecting package kernel for versions less than 6.6.96.1-1. A patched version of the package is available...

Malicious code in greater-than (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9287f16baf24f1b5d14e3cdae0ae58d583bcacfa0a19d78c41fc32b3fdce547c When imported, the package attempts to exfiltrate environment variables and basic user info --- Category: MALICIOUS - The campaign has clearly malicious intent...

MAL-2025-41681 Malicious code in greater-than (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9287f16baf24f1b5d14e3cdae0ae58d583bcacfa0a19d78c41fc32b3fdce547c When imported, the package attempts to exfiltrate environment variables and basic user info --- Category: MALICIOUS - The campaign has clearly malicious intent...

shlex crate 安全漏洞

shlex crate is a Rust library by comex individual developers. A security vulnerability exists in shlex crate versions prior to 1.2.1 that stems from unquoted and xa0 characters that may lead to command injection...

Gift Pad region PAY 日志信息泄露漏洞

Gift Pad region PAY is a digital region currency application from Gift Pad Japan. A log information disclosure vulnerability exists in Gift Pad region PAY versions prior to 1.5.28, which originates when sensitive information is inserted into a log file, potentially leading to information disclosu...

ZITADEL 安全漏洞

ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the container and serverless era from the Swiss ZITADEL open source. A security vulnerability exists in ZITADEL versions 4.0.0-rc.2, 3.3.2, 2.71.13, and prior to 2.70.14, which stems from a la...

CVE-2024-8925 affecting package php for versions less than 8.3.12-1

CVE-2024-8925 affecting package php for versions less than 8.3.12-1. A patched version of the package is available...

CVE-2025-5372 Libssh: incorrect return code handling in ssh_kdf() in libssh

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the sshkdf function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenl...

CVE-2025-6431 The prompt in Firefox for Android that asks before opening a link in an external application could be bypassed

When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed this prompt, potentially exposing the user to security vulnerabilities or privacy leaks in external applications. This bug only affects...

UBUNTU-CVE-2025-52937

Vulnerability in PointCloudLibrary PCL surface/src/3rdparty/opennurbs modules. This vulnerability is associated with program files crc32.C. This vulnerability is only relevant if the PCL version is older than 1.14.0 or the user specifically requests to not use the system zlib WITHSYSTEMZLIB=FALSE...

CVE-2025-50015 WordPress Hand Talk plugin <= 6.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rodrigo Bastos Hand Talk handtalk allows Stored XSS.This issue affects Hand Talk: from n/a through = 6.1...

AZL-63950 CVE-2025-38059 affecting package kernel for versions less than 6.6.96.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid NULL pointer dereference if no valid csum tree BUG When trying read-only scrub on a btrfs with rescue=idatacsums mount option, it will crash with the following call trace: BUG: kernel NULL pointer dereference, addres...

Astra Linux – Vulnerability in Firefox

Memory safety bugs exist in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability has be...

WordPress CozyStay Theme < 1.7.1 is vulnerable to Local File Inclusion

Software CozyStay Type Theme Vulnerable versions 1.7.1 Fixed in 1.7.1 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-49508 Patch priority High CVSS severity High 8.1 Developer LoftOcean PSID 0ccb72a10659 Credits Bonds Required privilege Unauthenticated Published 11...

CVE-2025-5791

A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list...

UBUNTU-CVE-2020-36846

A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library. Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a "one-shot" decompression request to a scrip...

SUSE CVE-2025-48057

Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. Prior to versions 2.12.12, 2.13.12, and 2.14.6, the VerifyCertificate function can be tricked into incorrectly treating certificates as vali...