PT-2025-27808 · Mediawiki · Campaignevents Extension +1

Name of the Vulnerable Software and Affected Versions: Mediawiki - CampaignEvents Extension versions 1.43.X through 1.43.1 Description: The issue affects the Mediawiki - CampaignEvents Extension, allowing Cross-Site Scripting XSS due to improper neutralization of input during web page generation...

PT-2025-27831 · Mediawiki +1 · Mediawiki Citizen Skin +1

Name of the Vulnerable Software and Affected Versions: Citizen MediaWiki skin versions 1.9.4 through 3.4.0 Description: The Citizen MediaWiki skin has an issue where short descriptions set via the ShortDescription extension are inserted as raw HTML, allowing any user to insert arbitrary HTML into...

Tenable Nessus Multiple Vulnerabilities (TNS-2025-13)

Tenable Nessus is prone to multiple vulnerabilities in various third-party components libxml2, libxslt. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Mozilla Thunderbird ESR Security Update (mfsa_2025-55) - Windows

Mozilla Thunderbird ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2025-27830 · Mediawiki · Mediawiki Citizen Skin

Name of the Vulnerable Software and Affected Versions: Citizen MediaWiki skin versions 1.9.4 through 3.4.0 Description: The Citizen MediaWiki skin has an issue where page descriptions are inserted into raw HTML without proper sanitization when using the old search bar. This allows any user with...

SUSE SLES15: aws-nitro-enclaves-binaryblobs-upstream / aws-nitro-enclaves-cli / etc (SUSE-SU-SUSE-RU-2025:02204-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-SUSE-RU-2025:02204-1 advisory. - Fix idna accepts Punycode labels that do not produce any non-ASCII when decoded bsc1243859 - Update to version 1.4....

Slackware Linux 15.0 / current php81 Multiple Vulnerabilities (SSA:2025-184-01)

The version of php81 installed on the remote host is prior to 8.1.33 / 8.2.29 / 8.4.10. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-184-01 advisory. New php packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracte...

CVE-2025-53358

Summary (CVE-2025-53358) : Kotaemon, an open‑source RAG-based document tool, is affected in versions up to 0.10.6. The function index_fn in libs/ktem/ktem/index/file/ui.py accepts both URLs and local file paths without validation, causing the pipeline to stream and store these paths. This enables...

SUSE-RU-2025:02204-1 Recommended update for aws-nitro-enclaves-cli

This update for aws-nitro-enclaves-cli fixes the following issues: - Fix idna accepts Punycode labels that do not produce any non-ASCII when decoded bsc1243859 - Update to version 1.4.2 - Update aws-nitro-enclaves-sdk-bootstrap to version f718dea6 - Update to version 1.3.3git0.afb7264 - Update...

PT-2025-27660 · Unknown · Xinference

Name of the Vulnerable Software and Affected Versions: Xinference versions prior to 1.4.0 Description: The issue is related to incorrect access control, allowing attackers to access the Web GUI without authentication. Recommendations: For versions prior to 1.4.0, update to version 1.4.0 or later ...

PT-2025-27640 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: Mediawiki - MintyDocs Extension versions 1.39.X through 1.43.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks...

CVE-2025-53099 Sentry Missing Invalidation of Authorization Codes During OAuth Exchange and Revocation

Sentry is a developer-first error tracking and performance monitoring tool. Prior to version 25.5.0, an attacker with a malicious OAuth application registered with Sentry can take advantage of a race condition and improper handling of authorization code within Sentry to maintain persistence to a...

CVE-2025-53099 Sentry Missing Invalidation of Authorization Codes During OAuth Exchange and Revocation

Sentry is a developer-first error tracking and performance monitoring tool. Prior to version 25.5.0, an attacker with a malicious OAuth application registered with Sentry can take advantage of a race condition and improper handling of authorization code within Sentry to maintain persistence to a...

PT-2025-27521 · Asr190X +3 · Asr190X +4

Name of the Vulnerable Software and Affected Versions: ASR180x versions prior to v1536 ASR190x versions prior to v1536 Falcon Linux versions prior to v1536 Kestrel versions prior to v1536 Lapwing Linux versions prior to v1536 Description: The issue is related to an Improper Resource Shutdown or...

PT-2025-27572 · Junit · Junit

Name of the Vulnerable Software and Affected Versions: JUnit versions 5.12.0 through 5.13.1 Description: The issue concerns JUnit's support for writing Open Test Reporting XML files, which can leak Git credentials. The impact depends on the level of the access token exposed through the...

SUSE SLED15: himmelblau / himmelblau-sshd-config / libnss_himmelblau2 / etc (SUSE-SU-2025:02166-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02166-1 advisory. - CVE-2025-5791: Fixed using deprecated users crate bsc1244202 - CVE-2025-3416: Fixed use-After-Free in...

Fedora 42 : gum (2025-ddcd03b103)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-ddcd03b103 advisory. Update to version 0.16.1 for various bugfixes. This also fixes CVE-2025-22872 in the bundled golang.org/x/net/html. Tenable has extracted the preceding...

PT-2025-27519

Name of the Vulnerable Software and Affected Versions: ASR180x versions prior to v1536 Falcon Linux versions prior to v1536 Kestrel versions prior to v1536 Lapwing Linux versions prior to v1536 Description: The issue is an out-of-bounds write in the lte-telephony component of ASR180x, which may...

CVE-2025-52995

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.10, the implementation of the allowlist is erroneous, allowing a user to execute more shell commands than they are authorized fo...

[SECURITY] [DLA 4235-1] sudo security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4235-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz June 30, 2025 https://wiki.debian.org/LTS -...