CVE-2024-11218 affecting package buildah for versions less than 1.41.4-2

CVE-2024-11218 affecting package buildah for versions less than 1.41.4-2. An upgraded version of the package is available that resolves this issue...

CVE-2025-58058 affecting package podman for versions less than 5.6.1-2

CVE-2025-58058 affecting package podman for versions less than 5.6.1-2. An upgraded version of the package is available that resolves this issue...

CVE-2025-48039 affecting package erlang for versions less than 26.2.5.15-1

CVE-2025-48039 affecting package erlang for versions less than 26.2.5.15-1. An upgraded version of the package is available that resolves this issue...

Server-side Request Forgery (SSRF)

Overview @astrojs/internal-helpers is an Internal helpers used by core Astro packages. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the /image endpoint. An attacker can access internal or unauthorized resources by submitting crafted URLs to the generate...

Amazon Linux 2 : docker, --advisory ALAS2ECS-2025-076 (ALASECS-2025-076)

The version of docker installed on the remote host is prior to 25.0.13-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2025-076 advisory. Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container...

UBUNTU-CVE-2025-61795

Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred including exceeding limits during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to...

Improper Preservation of Permissions

Overview Affected versions of this package are vulnerable to Improper Preservation of Permissions due to the improper removal of ClusterRoleBinding objects when a custom administrative global role or its binding is deleted. An attacker can retain unauthorized access to clusters by leveraging...

Security Bulletin: IBM Maximo Application Suite - Manage Component uses multer-1.4.5-lts.2.tgz which is vulnerable to CVE-2025-47935.

Summary Security Bulletin: IBM Maximo Application Suite - Manage Component uses multer-1.4.5-lts.2.tgz which is vulnerable to CVE-2025-47935. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2025-47935 DESCRIPTION: Multer is a node.js...

Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability (CVE-2014-3931)

The version of Multi-Router Looking Glass MRLG installed on the remote host is prior to 5.5.0. It is, therefore, affected by a memory-handling vulnerability in fastping.c that can be triggered remotely without authentication. Therefore, an attacker could send crafted input through the MRLG...

Security Bulletin: IBM Content Navigator consumes vulnerable spring framework library

Summary A bypass vulnerability where, despite CVE-2024-38820 ensuring Locale-independent lowercase conversion for disallowedFields patterns and request parameter names, there are still cases where it is possible to bypass the disallowedFields checks . Vulnerability Details CVEID:CVE-2025-22233...

Security Bulletin: IBM MQ is affected by a denial of service vulnerability in IBM WebSphere Application Server Liberty (CVE-2025-48976)

Summary IBM WebSphere Application Server Liberty is used by IBM MQ as part of the IBM MQ Console and IBM MQ REST API functionality CVE-2025-48976 Vulnerability Details CVEID:CVE-2025-48976 DESCRIPTION: Allocation of resources for multipart headers with insufficient limits enabled a DoS...

Debian dla-4344 : gdk-pixbuf-tests - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4344 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4344-1 [email protected] https://www.debian.org/lts/security/...

Unverified Ownership

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Unverified Ownership via the JWT authentication process. An attacker can gain unauthorized access to protected resources by presenting a valid token intended for a different audience when...

Files or Directories Accessible to External Parties

Overview io.vertx:vertx-web is a HTTP web applications for Vert.x. Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties via improper handling of hidden directories in the StaticHandler implementation when the setIncludeHiddenfalse configuration i...

External Control of File Name or Path

Overview aiomysql is a MySQL driver for asyncio. Affected versions of this package are vulnerable to External Control of File Name or Path via the LOADLOCAL instruction packet. An attacker can obtain arbitrary files from the client system by setting up a malicious MySQL server that sends crafted...

PT-2025-43273

Name of the Vulnerable Software and Affected Versions Arevico WP Tactical Popup versions through 1.1 Description The software contains a flaw related to improper input handling during web page generation, specifically a Reflected Cross-Site Scripting XSS issue. This allows for the injection of...

PT-2025-43409

Name of the Vulnerable Software and Affected Versions BookLore versions 1.8.1 and prior Description BookLore is a self-hosted web app for managing book collections. Versions prior to a recent update have an authentication bypass issue in the BookMediaController. This allows unauthenticated users ...

PT-2025-43195

Name of the Vulnerable Software and Affected Versions CrocoBlock JetSearch versions through 3.5.10 Description A flaw exists in CrocoBlock JetSearch that allows for Blind SQL Injection due to improper neutralization of special elements used in SQL commands. This issue could potentially allow an...

PT-2025-43167

Name of the Vulnerable Software and Affected Versions DELUCKS SEO versions through 2.5.9 Description A missing authorization flaw exists in DELUCKS SEO. This allows access to functionality that is not properly restricted by Access Control Lists ACLs. Recommendations Update DELUCKS SEO to a versio...

PT-2025-43211

Name of the Vulnerable Software and Affected Versions billingo Official Integration for Billingo versions through 4.2.5 Description A missing authorization flaw exists in billingo Official Integration for Billingo. This issue allows for privilege escalation. Recommendations Update billingo Offici...