Fedora: Security Advisory (FEDORA-2025-ada7909175)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2025:4190-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4190-1 advisory. - Update to version 3.19.1 - CVE-2025-53547: Fixed local code execution in Helm Chart. bsc1246152 - CVE-2025-58190:...

TencentOS Server 2: python-setuptools (TSSA-2025:0657)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0657 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

PT-2025-47263

Name of the Vulnerable Software and Affected Versions ACF Flexible Layouts Manager plugin for WordPress versions up to and including 1.1.6 Description The ACF Flexible Layouts Manager plugin for WordPress has a flaw that allows unauthorized modification of data. This is due to a missing capabilit...

PT-2025-47283

Name of the Vulnerable Software and Affected Versions Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin for WordPress versions prior to 3.22 Description The software is susceptible to Stored Cross-Site Scripting through its lightbox functionality. This is due to inadequate input...

PT-2025-47269

Name of the Vulnerable Software and Affected Versions Serv-U versions prior to 15.5.3 Description A Path Restriction Bypass exists in Serv-U that allows a malicious actor with administrative privileges to execute code on a directory. This requires administrative privileges to exploit. On Windows...

Mozilla Thunderbird ESR Security Update (mfsa_2025-91) - Mac OS X

Mozilla Thunderbird ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2025-47084

Name of the Vulnerable Software and Affected Versions Jiusi OA versions prior to 20251103 Description A security issue has been identified in Jiusi OA. The issue involves unrestricted upload capabilities through manipulation of the FileData argument within an unknown function of the...

PT-2025-46934

Name of the Vulnerable Software and Affected Versions SNORDIAN's H5PxAPIkatchu plugin for WordPress versions through 0.4.17 Description The software is susceptible to Stored Cross-Site Scripting through the insert data API endpoint. Insufficient input sanitization and output escaping allow...

Fedora 43 : gh (2025-6981d97f47)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-6981d97f47 advisory. Update to 2.83.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

Malicious code in betelgeuse-frontend-titan-yildun (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f95eac4fa944ac0a19a117f2cf25d1f3042447fe03373fb6878a2d5c26c18ffe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xanadu-proxima-transport-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4aeb08505911268d5477af6771dde49e5f8b308294908a14422197c264ce684f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185755 Malicious code in baryon-perturbation-javascript-pyxis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82e3b91264dd6978584ccce3d20c13f45009b8478f3c69fb0ec077a6d48a37fe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Google Chrome Security Update (stable-channel-update-for-desktop_11-2025-11) - Linux

Google Chrome is prone to a heap corruption vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome";...

PT-2025-46772

Name of the Vulnerable Software and Affected Versions ASUS DSL Series Routers affected versions not specified Description An authentication bypass issue exists in ASUS DSL series routers. This flaw allows remote, unauthenticated attackers to gain unauthorized access to affected systems...

Malicious code in avangs-olimois-noliadsdsgsgnu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3578c5502cc9ee86a8c80a193c5431afa859d94e45415156731ce21ea0be7590 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teagood-cuekin81 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35cc65789c4527801b40de9592c67a51ce5df356017c1fba0076f3367ac49fb9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-156312 Malicious code in ilop-9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49a35081871394befe6e9ca9aa5b2a1d4ec5e953d09d47d4c571ac9ffdb76482 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hafiz-poke16 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18b4f1e78dab4e44a61e6dc933002fdb3313f392c583a7c0c6dd7c1479c9ffea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nokire-abimanyu52 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c683c314055f749f47cc939cf2776e6c3e3cfaf69cdf8d9f3f43d8cb4365a10e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...