SUSE-SU-2026:0950-1 Security update for docker

This update for docker rebuilds it against the current go 1.25 security release...

WWBN AVideo 跨站脚本漏洞

WWBN AVideo is a video platform building system written in PHP, developed by the WWBN team. Versions of WWBN AVideo prior to 25.0 contained a cross-site scripting vulnerability. This vulnerability occurred because user inputs were passed directly to JavaScript without being escaped, allowing them...

WWBN AVideo 安全漏洞

WWBN AVideo is a video platform building system written in PHP, developed by the WWBN team. Versions of WWBN AVideo prior to 25.0 contained security vulnerabilities. These vulnerabilities stemmed from the install/checkConfiguration.php endpoint, which allowed unverified attackers to complete...

CVE-2026-3873

Use of Hard-coded Credentials vulnerability in Avantra allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Avantra: before 25.3.0...

CVE-2026-29795

stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::fromstr does not validate that the input length is within the declared maximum MAX. Calling StringM::::fromstrs where s is longer than N bytes succeeds and returns a...

CVE-2026-2409

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Delinea Cloud Suite allows Argument Injection.This issue affects Cloud Suite: before 25.2 HF1...

Ubuntu 25.10 : Pillow vulnerability (USN-8047-1)

The remote Ubuntu 25.10 host has packages installed that are affected by a vulnerability as referenced in the USN-8047-1 advisory. Yarden Porat discovered that Pillow incorrectly handled certain malformed PSD images. An attacker could use this issue to cause Pillow to crash, resulting in a denial...

CVE-2026-21325

CVE-2026-21325 affects After Effects versions 25.6 and earlier. It is an out-of-bounds read vulnerability triggered while parsing a crafted file, potentially allowing code execution in the context of the current user. Exploitation requires user interaction: the victim must open a malicious file. ...

Adobe After Effects 缓冲区错误漏洞

Adobe After Effects is a set of visual effects and motion graphics production software from the American company Audobee Adobe. The software is mainly used for 2D and 3D synthesis, animation and visual effects production. An out-of-bounds read vulnerability exists in Adobe After Effects 25.6 and...

GHSA-X24C-W26V-W8JG vulnerabilities

Vulnerabilities for packages: openjdk-21-openj9, openjdk-25-openj9, openjdk-8-openj9, openjdk-11-openj9, openjdk-17-openj9...

Microsoft Windows 资源管理错误漏洞

Microsoft Windows is a suite of operating systems for use on personal devices from Microsoft Corporation USA. Microsoft Windows suffers from a resource management error vulnerability. An attacker could exploit this vulnerability to remotely execute code. The following products and versions are...

EUVD-2026-1924

An issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via the BotManager.exe component...

@regis-samurai/n8n (>=0.216.1 <=0.219.1), n8n-nodes-accelo (>=0.1.0 <=0.1.9) +11 more potentially affected by CVE-2025-61914 via n8n (>=0.138.0 <=0.93.0)

n8n NPM version =0.138.0, =0.216.1, =0.1.0, =0.18.0, =0.1.0, =0.1.0, =0.2.14, =0.1.0, =0.1.0, =0.0.2, =0.0.2, =1.1.3 Source cves: CVE-2025-61914 Source advisory: OSV:GHSA-58JC-RCG5-95F3...

EUVD-2025-204811

NSF Unidata NetCDF-C Dimension Name Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability in that the target...

EUVD-2025-204574

DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2025-67035. Reason: This record is a reservation duplicate of CVE-2025-67035. Notes: All CVE users should reference CVE-2025-67035 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage...

EUVD-2025-204389

Command Injection vulnerability in TP-Link WA850RE httpd modules allows authenticated adjacent attacker to inject arbitrary commands.This issue affects: ≤ WA850RE V2160527, ≤ WA850RE V3160922...

EUVD-2025-202413

Direct Object Reference Vulnerability IDOR in i2A's CronosWeb, in versions prior to 25.00.00.12, inclusive. This vulnerability could allow an authenticated attacker to access other users' documents by manipulating the ‘documentCode’ parameter in...

CVE-2025-63499

Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting XSS via the theme parameter...

Ubuntu 25.10 : CRaC JDK 25 vulnerabilities (USN-7902-1)

The remote Ubuntu 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7902-1 advisory. Jinfeng Guo discovered that the Security component of CRaC JDK 25 did not correctly handle certain representations of encoded strings. An unauthenticated...

Malicious code in lala-poke25 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb1caf2bbb75d4495cb4a59950ca317f1458bda4c9f19b14c03c7c0dd89f0b4f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...