SUSE-SU-2025:02837-1 Security update for go1.24-openssl

This update for go1.24-openssl fixes the following issues: Updated to go1.24.6 released 2025-08-06 bsc1236217: - CVE-2025-4674: Fixed unexpected command execution in untrusted VCS repositories in cmd/go bsc1246118 - CVE-2025-47906: Fixed incorrect expansion of '', '.' and '..' in some PATH...

SUSE-SU-2025:02812-1 Security update for go1.23-openssl

This update for go1.23-openssl fixes the following issues: Updated to go1.23.12 released 2025-08-06 bsc1229122: - CVE-2025-4674: Fixed unexpected command execution in untrusted VCS repositories in cmd/go bsc1246118 - CVE-2025-47906: Fixed incorrect expansion of '', '.' and '..' in some PATH...

PT-2025-33493 · Plane · Plane

Name of the Vulnerable Software and Affected Versions: Plane versions prior to 0.28.0 Description: Plane is open-source project management software. A stored cross-site scripting XSS vulnerability exists in the description html field. This flaw allows an attacker to inject malicious JavaScript co...

SUSE: Security Advisory (SUSE-SU-2025:02760-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Advisory (SUSE-SU-2025:02759-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15 / openSUSE 15 Security Update : amber-cli (SUSE-SU-2025:02769-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:02769-1 advisory. - Update to version 1.13.1+git20250329.c2e3bb8: CVE-2025-30204: Fixed jwt-go excessive memory allocation during header parsin...

Security update for go1.24

This update for go1.24 fixes the following issues: Update to go1.24.6: CVE-2025-47906: Fixed LookPath returning unexpected paths bsc1247719 CVE-2025-47907: Fixed incorrect results returned from Rows.Scan bsc1247720 go73800 runtime: RSS seems to have increased in Go 1.24 while the runtime accounti...

Intel® DSA Software Advisory

Summary: A potential security vulnerability in some Intel® Driver & Support Assistant DSA software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2025-26404 Description: Uncontrolled search path fo...

PT-2025-32735 · Intel · Intel Graphics Driver For Intel Arc B-Series

Name of the Vulnerable Software and Affected Versions: IntelR Graphics Driver for the IntelR ArcTM B-Series graphics versions prior to 32.0.101.6737 Description: A protection mechanism failure exists in the IntelR Graphics Driver for the IntelR ArcTM B-Series graphics. This issue may allow an...

PT-2025-32668

Name of the Vulnerable Software and Affected Versions: Apache bRPC versions prior to 1.14.1 Description: A flaw in the Redis parser within Apache bRPC allows unauthenticated remote attackers to crash services by triggering unlimited memory allocation. This issue affects the service via network...

PT-2025-32960 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 139.0.7258.127 Description: A heap buffer overflow exists in libaom, a component of Google Chrome. This issue could allow a remote attacker to potentially exploit heap corruption through a curated set of...

Siemens RUGGEDCOM CROSSBOW Station Access Controller

SUMMARY RUGGEDCOM CROSSBOW Station Access Controller SAC contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code or to create a denial of service condition. Siemens has released a new version for RUGGEDCOM CROSSBOW Station...

CVE-2025-54787

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. There is a vulnerability in SuiteCRM version 7.14.6 which allows unauthenticated downloads of any file from the upload-directory, as long as it is named by an ID e.g. attachments. An...

CVE-2025-54130

Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions less than 1.3.9. If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence, if sensitive editor files, such as the...

CVE-2025-54798

CVE-2025-54798 concerns the tmp package for Node.js. In versions 0.2.3 and earlier, it is vulnerable to arbitrary temporary file and directory writes via the symbolic link dir parameter. The issue is fixed in version 0.2.4; users should upgrade to 0.2.4 or later to mitigate. The connected IBM bul...

CVE-2025-54798 tmp does not restrict arbitrary temporary file / directory write via symbolic link `dir` parameter

tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4...

PT-2025-32267 · Agora · Agora Foundation

Name of the Vulnerable Software and Affected Versions: Agora Foundation Agora versions prior to b087490 Description: The application is susceptible to a cross-site scripting XSS issue due to improper handling of the topicName parameter within the client/agora/public/js/editorManager.js file...

PT-2025-32310 · Unknown · San Host Utilities For Windows

Name of the Vulnerable Software and Affected Versions: SAN Host Utilities for Windows versions prior to 8.0 Description: The installer is susceptible to a vulnerability that could allow a local user to escalate their privileges when successfully exploited. Recommendations: Update to version 8.0 o...

CVE-2025-54397

Netwrix Directory Manager formerly Imanami GroupID 11.0.0.0 before 11.1.25162.02 inserts Sensitive Information Into Sent Data to authenticated users...

PT-2025-32252 · Akamai · Akamaighost

Name of the Vulnerable Software and Affected Versions: Akamai Ghost versions prior to 2025-03-26 Description: An issue exists in Akamai Ghost, used for the Akamai CDN platform. A client making an HTTP/1.x OPTIONS request with an "Expect: 100-continue" header, and using obsolete line folding, can...