PT-2025-7218

Name of the Vulnerable Software and Affected Versions: Exiv2 versions v0.28.0 through v0.28.4 Description: A heap buffer overflow was found in Exiv2 when used to write metadata into a crafted image file. This issue can be exploited by an attacker to gain code execution if they can trick the victi...

Azure Linux 3.0 Security Update: docker-buildx / docker-compose / moby-compose / moby-engine (CVE-2024-23650)

The version of docker-buildx / docker-compose / moby-compose / moby-engine installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-23650 advisory. - BuildKit is a toolkit for converting source code to bui...

Advisory ROSA-SA-2025-2683

Software: grub2 2.02 OS: ROSA Virtualization 3.0 packageevrstring: grub2-2.02-148.0.3 CVE-ID: CVE-2022-2601 BDU-ID: 2022-06819 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the grubfontconstructglyph function of the Grub2 operating systems boot loader is related to an operation exceeding buffer...

PT-2025-6717

Name of the Vulnerable Software and Affected Versions Brocade 6547 FC5022 versions prior to 8.2.3e1 pha Description The implementation of the Simple Network Management Protocol SNMP in the Brocade 6547 FC5022 embedded switch blade makes internal script calls to system.sh from within the SNMP...

CVE-2025-25204

gh is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool gh attestation verify causes it to return a zero exit status when no attestations are present. This behavior is incorrect:...

CVE-2025-25204

The CVE-2025-25204 issue affects GitHub CLI (gh) where, in versions 2.49.0 through 2.66.x, a bug in the Artifact Attestation tool gh attestation verify causes a zero exit status when no attestations are present. This incorrect exit code can enable attackers to deploy malicious artifacts in enviro...

CVE-2025-25204 `gh attestation verify` returns incorrect exit code during verification if no attestations are present

gh is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool gh attestation verify causes it to return a zero exit status when no attestations are present. This behavior is incorrect:...

PT-2025-6590 · WordPress · The Return Refund/Exchange For Woocommerce – Return Management System

Name of the Vulnerable Software and Affected Versions: The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress versions up to, and including, 4.4.5 Description: The issue allows unauthenticated attackers to...

AlmaLinux 8 : doxygen (ALSA-2025:1314)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:1314 advisory. jquery: Untrusted code execution via tag in HTML passed to DOM manipulation methods CVE-2020-11023 Tenable has extracted the preceding description block directly...

Microsoft High Performance Compute (HPC) Pack (CVE-2025-21198)

A remote code execution vulnerability exists in Microsoft High Performance Compute HPC Pack prior to 2019 update 3. An authenticated, adjacent attacker can exploit this to execute arbitrary commands on the target system. Note that Nessus has not tested for this issue but has instead relied only o...

Debian: Security Advisory (DSA-5866-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-6591 · WordPress · Dethemekit For Elementor

Name of the Vulnerable Software and Affected Versions: DethemeKit For Elementor plugin for WordPress versions up to, and including, 2.1.8 Description: The issue is related to Stored Cross-Site Scripting via the plugin's De Gallery widget due to insufficient input sanitization and output escaping ...

Ubuntu: Security Advisory (USN-7238-4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Photon OS 4.0: Libtiff PHSA-2024-4.0-0680

An update of the libtiff package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-4.0-0680. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Fedora 40 : python3.10 (2025-10e053d399)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-10e053d399 advisory. Security fix for CVE-2025-0938 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Fedora: Security Advisory (FEDORA-2025-6f07616b52)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Office Multiple Vulnerabilities (Feb 2025) - Mac OS X

This host is missing an important security update for Microsoft Office on Mac OSX according to Microsoft security update February 2025 SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

PT-2025-6465 · WordPress · Ltl Freight Quotes – Xpo Edition

Name of the Vulnerable Software and Affected Versions: LTL Freight Quotes – XPO Edition plugin for WordPress versions up to, and including, 4.3.7 Description: The issue allows for SQL Injection via the edit id and dropship edit id parameters due to insufficient escaping on user-supplied parameter...

KLA80204 Multiple vulnerabilities in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to cause denial of service. Below is a complete list of vulnerabilities: 1. Out of bounds memory access in V8 can be exploited to cause denial of service. 2. Use after free in Navigation can be...

openSUSE 15 Security Update : python310 (SUSE-SU-2025:0406-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:0406-1 advisory. - CVE-2025-0938: domain names containing square brackets are not identified as incorrect by urlparse. bsc1236705 Tenable has extracted the preceding...