CVE-2025-48485

CVE-2025-48485 affects FreeScout prior to version 1.8.180, where an authenticated user updating a customer’s profile could trigger a Cross-Site Scripting (XSS) vulnerability due to improper input validation and sanitization. The issue is mitigated by upgrading to version 1.8.180, which patches th...

CVE-2025-48484 FreeScout Vulnerable to Stored XSS

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, the application is vulnerable to Cross-Site Scripting XSS attacks due to incorrect input validation and sanitization of user-input data in the conversation POST data body. This issue has been patched in versio...

CVE-2025-48484 FreeScout Vulnerable to Stored XSS

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, the application is vulnerable to Cross-Site Scripting XSS attacks due to incorrect input validation and sanitization of user-input data in the conversation POST data body. This issue has been patched in versio...

CVE-2025-48482 FreeScout Has Business Logic Errors

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, there is a mass assignment vulnerability. The Customer object is updated using the fill method, which processes fields such as channel and channelid. However, the fill method is called with all client-provided...

CVE-2025-48479

CVE-2025-48479 affects FreeScout (self-hosted help desk) via the laravel-translation-manager package. The issue arises from improper validation of user input, enabling deletion of arbitrary directories when the attacker has sufficient access rights. The vulnerability is addressed in FreeScout ver...

CVE-2025-46823

openmrs-module-fhir2 provides the FHIR REST API and related services for OpenMRS, an open medical records system. In versions of the FHIR2 module prior to 2.5.0, privileges were not always correctly checked, which means that unauthorized users may have been able to add or edit data they were not...

CVE-2025-46823 OpenMRS has Vulnerability in FHIR2 Module Privileges

openmrs-module-fhir2 provides the FHIR REST API and related services for OpenMRS, an open medical records system. In versions of the FHIR2 module prior to 2.5.0, privileges were not always correctly checked, which means that unauthorized users may have been able to add or edit data they were not...

CVE-2025-46722 vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

vLLM is an inference and serving engine for large language models LLMs. In versions starting from 0.7.0 to before 0.9.0, in the file vllm/multimodal/hasher.py, the MultiModalHasher class has a security and data integrity issue in its image hashing method. Currently, it serializes PIL.Image.Image...

CVE-2025-48474

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application incorrectly checks user access rights for conversations. Users with showonlyassignedconversations enabled can assign themselves to an arbitrary conversation from the mailbox to which they have...

CVE-2025-48389

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to deserialization of untrusted data due to insufficient validation. Through the set function, a string with a serialized object can be passed, and when getting an option through the ge...

CVE-2025-48471 FreeScout Vulnerable to Arbitrary File Upload

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, the application does not check or performs insufficient checking of files uploaded to the application. This allows files to be uploaded with the phtml and phar extensions, which can lead to remote code executi...

CVE-2025-48742

The installer in SIGB PMB before and fixed in v.8.0.1.2 allows remote code execution...

PT-2025-23229 · Navidrome · Navidrome

Name of the Vulnerable Software and Affected Versions: Navidrome versions prior to 0.56.0 Description: A permission verification flaw in Navidrome allows any authenticated regular user to bypass authorization checks and perform administrator-only transcoding configuration operations, including...

PT-2025-25424 · Drupal · Drupal Cookies Consent Management

Name of the Vulnerable Software and Affected Versions: Drupal COOKiES Consent Management versions 0.0.0 through 1.2.14 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, in Drupal COOKiES Consent Management. Th...

Debian dsa-5926 : firefox-esr - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5926 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5926-1 [email protected] https://www.debian.org/securit...

PT-2025-23080 · Johnson Controls · Istar Config Utility

Name of the Vulnerable Software and Affected Versions: Johnson Controls' iSTAR Config Utility versions prior to 6.9.5 Description: A memory leak flaw in the iSTAR Config Utility could lead to data leaks, potentially exposing sensitive information. The issue affects versions prior to 6.9.5. Updati...

PT-2025-23106

Name of the Vulnerable Software and Affected Versions Kea versions 2.4.0 through 2.4.1 Kea versions 2.6.0 through 2.6.2 Kea versions 2.7.0 through 2.7.8 Description In some cases, Kea log files or lease files may be world-readable. Recommendations For Kea versions 2.4.0 through 2.4.1, update to a...

PT-2025-23137 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to v2.13.8 Argo CD versions prior to v2.14.13 Argo CD versions prior to v3.0.4 Description: This issue allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, an...

PT-2025-23109 · Netwrix · Netwrix Directory Manager

Name of the Vulnerable Software and Affected Versions: Netwrix Directory Manager versions prior to 11.1.25134.03 Description: The issue is related to Incorrect Permission Assignment for a Critical Resource. Recommendations: For versions prior to 11.1.25134.03, update to version 11.1.25134.03 or...

SUSE SLES15 / openSUSE 15 Security Update : govulncheck-vulndb (SUSE-SU-2025:01713-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:01713-1 advisory. - Update to version 0.0.20250523T151856 2025-05-23T15:18:56Z jscPED-11136 GO-2025-3699 GO-2025-3690 GO-2025-3691 GO-2025-3692 GO-2025-369...