CVE-2025-15437

LigeroSmart (up to 6.1.24) has a cross-site scripting vulnerability in the Environment Variable Handler, triggered by manipulation of the REQUEST_URI argument. The attack can be initiated remotely and an exploit has been publicly disclosed. Remediation: upgrade to LigeroSmart 6.1.26 or 6.3; patch...

CVE-2025-68113

ALTCHA is privacy-first software for captcha and bot protection. A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to...

PT-2025-51974

Name of the Vulnerable Software and Affected Versions Storybook versions prior to 7.6.21 Storybook versions prior to 8.6.15 Storybook versions prior to 9.1.17 Storybook versions prior to 10.1.10 Description Storybook’s handling of environment variables defined in a .env file can, in certain...

Security update for postgresql17, postgresql18

This update for postgresql17, postgresql18 fixes the following issues: Changes in postgresql18: Fix build with uring for post SLE15 code streams. Update to 18.1: https://www.postgresql.org/about/news/p-3171/ https://www.postgresql.org/docs/release/18.1/ bsc1253332, CVE-2025-12817: Missing check f...

Contao is vulnerable to remote code execution in template closures

Impact Backend users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. Patches Update to Contao 4.13.57, 5.3.42 or 5.6.5 Workarounds Manually patch the Contao\Template::once method. Resources...

webkit2gtk3 security update

2.50.1-1 - Update to 2.50.1 2.50.0-1 - Update to 2.50.0 2.48.5-1 - Update to 2.48.5 2.48.3-1 - Update to 2.48.3 2.48.2-1 - Update to 2.48.2 - Reenable JIT 2.48.1-1 - Update to 2.48.1 2.48.0-1 - Update to 2.48.0 2.46.6-1 - Update to 2.46.6 2.46.5-1 - Update to 2.46.5 2.46.4-1 - Update to 2.46.4...

PT-2025-47449

An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary command execution on the Looker instance. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for...

Deserialization of Untrusted Data

Overview drupal/core is an an open source content management platform powering millions of websites and applications. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via improper handling of dynamically-determined object attributes. An attacker who has...

CVE-2025-64329

A flaw was found in containerd. This vulnerability allows a user to exhaust memory on the host due to goroutine leaks via a bug in the CRI Container Runtime Interface Attach implementation...

DEBIAN-CVE-2025-59840

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 6.2.0, applications meeting 2 conditions are at risk of arbitrary JavaScript code execution, even if "safe mode" expressionInterpreter is used. They...

Malicious code in test-fork-gravity-puppeteer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2cd155e14b0f3d8707048a509a44689422afdacf2b452915a05a5894bcc2dbd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-45403

Name of the Vulnerable Software and Affected Versions containerd versions 1.7.28 and below containerd versions 2.0.0-beta.0 through 2.0.6 containerd versions 2.1.0-beta.0 through 2.1.4 containerd versions 2.2.0-beta.0 through 2.2.0-rc.1 Description containerd, an open-source container runtime, is...

Security update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, cont

This update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer fixes the following issues: Update to version 1.62.0: Release notes:...

PT-2025-45645

Name of the Vulnerable Software and Affected Versions Request Tracker versions prior to 4.4.4+dfsg-2+deb11u5 Request Tracker versions prior to 4.4.6+dfsg-1.1+deb12u3 Request Tracker versions prior to 5.0.3+dfsg-3deb12u4 Request Tracker versions prior to 5.0.7+dfsg-4+deb13u1 Description Request...

EUVD-2014-3560

Malware in sbrugna...

EUVD-2023-49458

Malicious code in bioql PyPI...

EUVD-2022-1778

Malicious code in bioql PyPI...

EUVD-2022-7642

Malicious code in bioql PyPI...

openSUSE 15 Security Update : mybatis, ognl (SUSE-SU-2025:03285-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:03285-1 advisory. Version update to 3.5.7: Bug fixes: - Improved performance under JDK 8. 2223 Version update to 3.5.8: List of changes: - Avoid NullPointerException when...

Fedora 29 : edk2 (2019-bff1cbaba3)

The remote Fedora 29 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2019-bff1cbaba3 advisory. Use YYYYMMDD versioning to fix upgrade path ---- Update to stable-201903 Update to openssl-1.1.0j Move to python3 deps Tenable has extracted the...