Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to Multer middleware of node.js (CVE-2025-48997).

Summary Multer is vulnerable to a denial of service attack. This vulnerability affects IBM Spectrum Control. Vulnerability Details CVEID:CVE-2025-48997 DESCRIPTION: Multer is a node.js middleware for handling multipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and...

PT-2025-45379

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 5.14.1 Description Weblate versions 5.14 and below disclose the IP address of a project member when inviting a user to a project. The audit log, which includes IP addresses from administrative actions, is accessible t...

Origin Validation Error

Overview @strapi/core is a Core of Strapi Affected versions of this package are vulnerable to Origin Validation Error due to the improper validation of the Origin header in the CORS configuration. An attacker can access sensitive information by hosting a malicious site on a different origin and...

CVE-2025-61733

Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are recommended to upgrade to version 5.0.3, which fixes the issue...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Improper Input Validation in Apache Tomcat [CVE-2025-31650]

Summary IBM Watson Speech Services Cartridge is vulnerable to an Improper Input Validation in Apache Tomcat, caused by incorrect error handling for some invalid HTTP priority headers, resulting in incomplete clean-up of the failed request, which creates a memory leak CVE-2025-31650 Apache Tomcat ...

CVE-2025-55675

Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasourceid in the URL, an attacker can...

PT-2025-32464 · Emqx · Emqx

Name of the Vulnerable Software and Affected Versions: EMQX versions prior to 5.8.6 Description: Administrators could install arbitrary novel plugins via the Dashboard web interface. The supplier considers this intended behavior; however, version 5.8.6 introduced a defense-in-depth feature...

PT-2025-32443 · Tduckcloud · Tduck-Platform

Name of the Vulnerable Software and Affected Versions: TDuckCloud tduck-platform versions prior to 5.2 Description: A critical issue exists in TDuckCloud tduck-platform prior to version 5.2 related to improper authorization. The vulnerability is located in the preHandle function of the /manage/...

Improper Verification of Cryptographic Signature

Overview @node-saml/node-saml is a SAML 2.0 implementation for Node.js Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to loading assertions from unsigned response documents. An attacker can alter authentication details, such as modifying t...

UBUNTU-CVE-2025-49656

Users with administrator access can create databases files outside the files area of the Fuseki server. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which fixes the issue...

CVE-2023-2822

A vulnerability was found in Ellucian Ethos Identity up to 5.10.5. It has been classified as problematic. Affected is an unknown function of the file /cas/logout. The manipulation of the argument url leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

SUSE CVE-2025-30195

An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illegal memory accesses and crash of the Recursor, causing a denial of service. The remedy is: upgrade to the patched 5.2.1 version. We would like to thank Volodym...

PT-2025-9052

Name of the Vulnerable Software and Affected Versions radare2 versions prior to 5.9.9 Description The issue is an Out-of-bounds Write vulnerability that allows heap-based buffer over-read or buffer overflow. This can lead to a buffer overflow, which is a type of attack where more data is written ...

DEBIAN-CVE-2024-56334

systeminformation is a System and OS information library for node.js. In affected versions SSIDs are not sanitized when before they are passed as a parameter to cmd.exe in the getWindowsIEEE8021x function. This means that malicious content in the SSID can be executed as OS commands. This...

PT-2024-34381 · Crmeb · Crmeb

Name of the Vulnerable Software and Affected Versions: CRMEB versions prior to 5.4.0 Description: The issue allows users to bypass the front-end restriction of only being able to claim coupons once. This can be achieved by capturing packets and sending a large number of data packets for coupon...

Improper Input Validation

Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Improper Input Validation through the Dropdown component's pre-processing step. An attacker can manipulate input data by sending custom requests with...

PT-2024-21052 · Elabftw · Elabftw

Name of the Vulnerable Software and Affected Versions: eLabFTW versions prior to 5.1.0 Description: The issue allows a regular user to become an administrator of a team where they are a member, under a reasonable configuration. In versions subsequent to v5.0.0, it may also allow an initially...

PT-2024-6068

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.13 Django versions 5.0 through 5.0.6 Description The issue is related to the get supported language variant function in Django, which can be subject to a potential denial-of-service attack when used with very lo...

PT-2024-20171 · Merge · Merge Dicom Toolkit C/C++

Name of the Vulnerable Software and Affected Versions: Merge DICOM Toolkit C/C++ versions ≤5.17.0 Description: The issue is related to the use of an externally-controlled format string vulnerability in the Merge DICOM Toolkit C/C++ on Windows. When the MC Open Association function is used to open...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index when sending a malformed packet with the correct length. An attacker can crash the system or cause an out of bounds read by exploiting this vulnerability. Remediation Upgrade wolfssl to version 5.7.0 o...