Spring_framework 5.3.x < 5.3.43 / 6.0.x < 6.0.28 / 6.1.x < 6.1.20 / 6.2.x < 6.2.7 (CVE-2025-22233)

The version of Springframework installed on the remote host is prior to 5.3.43, 6.0.28, 6.1.20, or 6.2.7. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-22233 advisory. - CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured...

CVE-2002-2195

Buffer overflow in the version update check for Winamp 2.80 and earlier allows remote attackers who can spoof www.winamp.com to execute arbitrary code via a long server response...

CVE-2025-47949

samlify is a Node.js library for SAML single sign-on. A Signature Wrapping attack has been found in samlify prior to version 2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the identity provider. Version 2.10.0 fix...

CLSA-2025-1747854497 Update of expat

Version was updated...

CVE-2025-47291

containerd is an open-source container runtime. A bug was found in the containerd's CRI implementation where containerd, starting in version 2.0.1 and prior to version 2.0.5, doesn't put usernamespaced containers under the Kubernetes' cgroup hierarchy, therefore some Kubernetes limits are not...

CVE-2025-48069

CVE-2025-48069 affects the ejson2env tool (Shopify) prior to version 2.0.8, where stdout writes are not adequately sanitized. The vulnerability permits variable names or values in decrypted EJSON to inject additional commands when the exported environment variables are evaluated or sourced, poten...

containerd allows host filesystem access on pull

Impact A time-of-check to time-of-use TOCTOU vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. Patches This bug has been fixed in the following containerd versions: 2.1.1 T...

CVE-2025-1417 Information disclosure in Proget MDM

In Proget MDM, a low-privileged user can access information about changes contained in backups of all devices managed by the MDM Mobile Device Management. This information include user ids, email addresses, first names, last names and device UUIDs. The last one can be used for exploitation of...

CVE-2025-1415

A low-privileged user is able to obtain information about tasks executed on devices controlled by Proget MDM Mobile Device Management, as well as details of the devices like their UUIDs needed for exploitation of CVE-2025-1416. In order to perform the attack, one has to know a taskid, but since...

SUSE-SU-2025:20353-1 Security update for runc

This update for runc fixes the following issues: Update to runc v1.2.6. Upstream changelog is available from . Update to runc v1.2.0rc3. Upstream changelog is available from . - CVE-2024-45310: Fixed that runc can be tricked into creating empty files/directories on host bsc1230092...

PT-2025-22375

Name of the Vulnerable Software and Affected Versions TYPO3 ns backup extension versions prior to 13.0.1 Description The issue allows for XSS. Recommendations For versions prior to 13.0.1, update to version 13.0.1 or later to resolve the issue...

PT-2025-22491 · Infoblox · Infoblox Netmri

Name of the Vulnerable Software and Affected Versions: Infoblox NETMRI versions prior to 7.6.1 Description: An unauthenticated SQL injection issue exists in Infoblox NETMRI. Exploitation of this issue may allow a remote attacker to execute arbitrary code. The vulnerability is related to the lack ...

PT-2025-22323 · WordPress · Digits: Wordpress Mobile Number Signup/Login

Name of the Vulnerable Software and Affected Versions: The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin versions prior to 8.4.6.1 Description: The issue concerns the lack of rate limiting for OTP validation attempts, making it possible for attackers to brute force them...

PT-2025-22507 · Ibm · Ibm Aspera Faspex

Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex versions 5.0.0 through 5.0.12 Description: The issue allows a remote attacker to inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

PT-2025-22400 · Hypr · Hypr Passwordless

Name of the Vulnerable Software and Affected Versions: HYPR Passwordless versions prior to 10.1 Description: The issue is related to a 'Race Condition' vulnerability due to improper synchronization when using shared resources, allowing privilege escalation. This vulnerability affects HYPR...

redis:7 security update

7.2.8-1 - rebase to 7.2.8 for CVE-2025-21605 7.2.7-1 - rebase to 7.2.7 for CVE-2024-46981 and CVE-2024-51741 7.2.6-1 - rebase to 7.2.6 RHEL-26628 7.0.12-1 - rebase to 7.0.12 2221899 7.0.11-1 - rebase to 7.0.11 for new redis:7 stream 2129826...

PT-2025-22459 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 17.10.7 GitLab CE/EE version 17.11 prior to 17.11.3 GitLab CE/EE version 18.0 prior to 18.0.1 Description: An issue has been discovered in GitLab CE/EE that could allow an authenticated attacker to cause a denia...

PT-2025-22350 · Unknown · Konsola Proget

Name of the Vulnerable Software and Affected Versions: Konsola Proget versions prior to 2.17.5 Description: A low-privileged user can access information about profiles created in Proget MDM, which contain details about allowed/prohibited functions. The profiles do not reveal any sensitive...

PT-2025-22387 · Drupal · Drupal Single Content Sync

Name of the Vulnerable Software and Affected Versions: Drupal Single Content Sync versions 0.0.0 through 1.4.11 Description: The issue is related to a Missing Authorization vulnerability in Drupal Single Content Sync, which allows functionality misuse. Recommendations: For versions 0.0.0 through...

GHSA-9HQ9-CR36-4WPJ TYPO3 Allows Unrestricted File Upload in File Abstraction Layer

Problem By design, the file management module in TYPO3’s backend user interface has historically allowed the upload of any file type, with the exception of those that are directly executable in a web server context. This lack of restriction means it is possible to upload files that may be...