SUSE CVE-2025-53547

Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when...

GHSA-9MP4-77WG-RWX9 @clerk/backend Performs Insufficient Verification of Data Authenticity

Impact Applications that use the verifyWebhook helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events. Patches @clerk/backend: the helper has been patched as of 2.4.0 @clerk/astro: the helper has been patched as of 2.10.2 @clerk/express: the helper...

CGA-P5QG-MPGW-8827

Bulletin has no description...

Vulnerabilities fixed in Adobe Illustrator

Adobe has fixed vulnerabilities in Adobe Illustrator Versions 28.7.6, 29.5.1 and earlier. The vulnerabilities are in the way Adobe Illustrator handles rogue files. These vulnerabilities can lead to arbitrary code execution, allowing attackers to perform unauthorized actions on affected systems. T...

Local Code Execution (LCE)

helm.sh/helm/v3 is vulnerable to Local Code Execution LCE. The vulnerability is due to insufficient validation and sanitization of the Chart.yaml and Chart.lock files during dependency updates, allowing a maliciously crafted file to trigger local code execution...

Microsoft Patch Tuesday, July 2025 Edition

Microsoft today released updates to fix at least 137 security vulnerabilities in its Windows operating systems and supported software. None of the weaknesses addressed this month are known to be actively exploited, but 14 of the flaws earned Microsoft's most-dire "critical" rating, meaning they...

HPESBHF04868 rev.1 - HPE Superdome Flex, Flex 280 and Compute Scale-up Server 3200 Platform Servers Using Intel Processor BIOS, INTEL-SA-01247, 2025.2 IPU - Intel Processor Indirect Branch Predictor Advisory, Local Disclosure of Information Vulnerability

Potential Security Impact: Local: Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Compute Scale-up Server 3200 - Prior to v1.60.88 HPE Superdome Flex 280 Server - Prior to v2.00.12 HPE Superdome Flex Server - Prior to v4.10.18 CVSS Scores: | CVE | CVS...

Photon OS 5.0: Python3 PHSA-2025-5.0-0554

An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0554. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

PT-2025-29253

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS versions prior to 22.2R3-S7 Juniper Networks Junos OS versions 22.4 through 22.4R3-S5 Juniper Networks Junos OS versions 23.2 through 23.2R2-S3 Juniper Networks Junos OS versions 23.4 through 23.4R2-S3 Juniper Networ...

PT-2025-29071 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 13.3 through 17.11.5 GitLab EE versions 18.0 through 18.0.3 GitLab EE versions 18.1 through 18.1.1 Description: An issue exists in GitLab EE that allows authenticated project owners to bypass group-level forking restriction...

PT-2025-29247 · Juniper Networks · Junos Evolved +1

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS versions prior to 21.2R3-S9 Juniper Networks Junos OS versions 21.4 through 21.4R3-S11 Juniper Networks Junos OS versions 22.2 through 22.2R3-S7 Juniper Networks Junos OS versions 22.4 through 22.4R3-S7 Juniper...

Photon OS 3.0: Bluez PHSA-2023-3.0-0580

An update of the bluez package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-3.0-0580. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Oracle Linux 10 : libxml2 (ELSA-2025-10630)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-10630 advisory. - Fix CVE-2025-6021 RHEL-96495 - Fix CVE-2025-49794 RHEL-96395 - Fix CVE-2025-49795 RHEL-96408 Tenable has extracted the preceding description block...

Microsoft Windows Multiple Vulnerabilities (KB5062554)

This host is missing an important security update according to Microsoft KB5062554 SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Microsoft Office 365 (2016 Click-to-Run) RCE Vulnerability (Jul 2025)

This host is missing a critical security update according to Microsoft Office Click-to-Run update July 2025. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Microsoft PowerPoint 2016 Multiple RCE Vulnerabilities (KB5002746)

This host is missing an important security update according to Microsoft KB5002746 SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

AZL-64877 CVE-2025-53547 affecting package helm for versions less than 3.14.2-7

Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when...

Arbitrary Code Injection

Overview helm.sh/helm/v3/pkg/downloader is a Package downloader provides a library for downloading charts. Affected versions of this package are vulnerable to Arbitrary Code Injection via the writeLock function. An attacker can execute arbitrary code by supplying crafted chart templates containin...

Microsoft and Adobe Patch Tuesday, July 2025 Security Update Review

With cybersecurity threats continuing to evolve, Microsoft's July 2025 Patch Tuesday highlights the need for consistent patching — this month's release includes key fixes for actively exploited vulnerabilities. Here's a quick breakdown of what you need to know. Microsoft Patch Tuesday for July 20...

Vulnerabilities fixed in Microsoft Visual Studio

Microsoft has fixed vulnerabilities in Visual Studio. A malicious person could exploit the vulnerabilities to grant themselves elevated privileges, or execute arbitrary code. Some of the vulnerabilities were previously fixed in the code of several open source projects related to GIT. Visual Studi...