Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: Update to version 0.0.20251029T215107 2025-10-29T21:51:07Z. jscPED-11136: GO-2025-4006 GO-2025-4007 GO-2025-4008 GO-2025-4009 GO-2025-4010 GO-2025-4011 GO-2025-4012 GO-2025-4013 GO-2025-4014 GO-2025-4015 Patch Instructions: To install...

SUSE SLED15: himmelblau / himmelblau-sshd-config / libnss_himmelblau2 / etc (SUSE-SU-2025:3869-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:3869-1 advisory. Update to version 0.7.18+git.0.8485a75. - CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI esca...

SUSE-SU-2025:3869-1 Security update for himmelblau

This update for himmelblau fixes the following issues: Update to version 0.7.18+git.0.8485a75. - CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI escape sequences could be injected into terminal output when logged bsc1249013...

PT-2025-44400

Name of the Vulnerable Software and Affected Versions CSZ-CMS versions prior to 1.3.1 Description A SQL injection issue exists in the Form Builder view functionality. The vulnerability is located in the field parameter of the form viewing feature, allowing authenticated administrators to execute...

PT-2025-44275

Name of the Vulnerable Software and Affected Versions Call Now Button versions prior to 1.5.5 Description The Call Now Button plugin for WordPress is susceptible to unauthorized data access because of a missing capability check in multiple functions. Attackers with Subscriber-level access or high...

PT-2025-44260

Name of the Vulnerable Software and Affected Versions Rometheme RTMKit versions through 1.6.7 Description An authorization bypass exists in Rometheme RTMKit rometheme-for-elementor due to incorrectly configured access control security levels. This allows exploitation through a user-controlled key...

CVE-2025-62794

CVE-2025-62794 affects the GitHub Workflow Updater VS Code extension. Before version 0.0.7, the extension stored provided GitHub tokens in plaintext JSON in editor configuration on disk instead of using securestorage. This allowed a local attacker with read access to the user’s home directory to ...

PT-2025-44151

Name of the Vulnerable Software and Affected Versions Asseco mMedica versions prior to 11.9.5 Description An unauthenticated user can connect to a publicly accessible database using arbitrary credentials. The system grants full access to the database by leveraging a previously authenticated...

CLSA-2025-1761596531 Update of microcode_ctl

Update version - Drop releasenote.md file...

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: Update to version 0.0.20251023T162509 2025-10-23T16:25:09Z jscPED-11136. Go CVE Numbering Authority IDs added or updated with aliases: GO-2025-3979 CVE-2025-59824 GHSA-hqrf-67pm-wgfq GO-2025-3981 CVE-2025-59823 GHSA-227x-7mh8-3cf6...

Medium: python3.11

Issue Overview: The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory EOCD Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be...

PT-2025-43878

Name of the Vulnerable Software and Affected Versions Iqbolshoh php-business-website versions prior to 10677743a8dfc281f85291a27cf63a0bce043c24 Description A cross-site scripting issue exists in Iqbolshoh php-business-website. The issue is located in the admin/contact.php file, where manipulation...

PT-2025-43903

Name of the Vulnerable Software and Affected Versions chatwoot versions up to 4.7.0 Description A security flaw exists in chatwoot affecting the Admin Interface component, specifically within the app/javascript/shared/components/IframeLoader.vue file. Manipulation of the Link argument can lead to...

PT-2025-43263

Name of the Vulnerable Software and Affected Versions WooCommerce Orders & Customers Exporter versions through 5.4 Description The software contains a missing authorization issue due to incorrectly configured access control security levels. This allows for exploitation of the access control...

CLSA-2025-1761056432 Update of libxslt

Bump version to 1.1.28-6.0.3.tuxcare.els1...

PT-2025-42933

Name of the Vulnerable Software and Affected Versions Oracle Financial Services Analytical Applications Infrastructure versions 8.0.7.9 through 8.0.8.7 Oracle Financial Services Analytical Applications Infrastructure version 8.1.2.5 Description An easily exploitable issue exists in the Oracle...

PT-2025-55295

Bump version to 1.1.28-6.0.3.tuxcare.els1...

Oracle Linux 8 : webkit2gtk3 (ELSA-2025-18070)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-18070 advisory. 2.50.1-1 - Update to 2.50.1 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not...

JLSEC-2025-39 Possible XSS in HTMLSanitizer when using svg elements

Description When adding the style tag to the whitelist, content inside the tag is incorrectly unescaped, and closing tags injected as content are interpreted as real HTML, enabling tag injection and JavaScript execution. This behavior is similar to the sanitization bypass described in CVE-2020-40...

Low: docker

Issue Overview: Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. A firewalld vulnerability affects Moby releases before 28.0.0. When firewalld reloads, Docker fails...