CVE-2025-24901 SQL Injection endpoint 'deletar_permissao.php' parameter 'c', 'a', 'r' in WeGIA

WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, deletarpermissao.php endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information...

CVE-2025-24906 SQL Injection endpoint 'get_detalhes_cobranca.php' parameter 'codigo' in WeGIA

WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, getdetalhescobranca.php endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive...

CVE-2025-24957 SQL Injection endpoint 'get_detalhes_socio.php' parameter 'id_socio' in WeGIA

WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, getdetalhessocio.php endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information...

CVE-2025-24958 SQL Injection endpoint 'salvar_tag.php' parameter 'id_tag' in WeGIA

WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, salvartag.php endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. This...

CVE-2025-24899

reNgine is an automated reconnaissance framework for web applications. A vulnerability was discovered in reNgine, where an insider attacker with any role such as Auditor, Penetration Tester, or Sys Admin can extract sensitive information from other reNgine users. After running a scan and obtainin...

CVE-2025-24370

Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn are vulnerable to python class pollution vulnerability. The vulnerability arises from the core functionality setpropertyvalue, which can be remotely triggered by users by crafting...

CVE-2025-24899 Disclosure of Sensitive User Information via API in reNgine

reNgine is an automated reconnaissance framework for web applications. A vulnerability was discovered in reNgine, where an insider attacker with any role such as Auditor, Penetration Tester, or Sys Admin can extract sensitive information from other reNgine users. After running a scan and obtainin...

CVE-2025-24959 Environment Variable Injection for dotenv API in zx

zx is a tool for writing better scripts. An attacker with control over environment variable values can inject unintended environment variables into process.env. This can lead to arbitrary command execution or unexpected behavior in applications that rely on environment variables for...

SUSE-SU-2025:0340-1 Security update for rsync

This update for rsync fixes the following issues: - Bump rsync protocol version to 32 to show server is patched against recent vulnerabilities...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition in the JSONFileDocumentDatabase during delete and update operations. Remediation Upgrade parlant to version 1.4.2 or higher. References - GitHub Commit...

CBL Mariner 2.0 Security Update: git-lfs (CVE-2024-53263)

The version of git-lfs installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-53263 advisory. - Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a...

Debian dla-4038 : dcmtk - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4038 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4038-2 [email protected] https://www.debian.org/lts/security/...

PT-2025-5629 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 2.13.4 Argo CD versions prior to 2.12.10 Argo CD versions prior to 2.11.13 Description: A vulnerability was discovered that exposes secret values in error messages and the diff view when an invalid Kubernetes Secret...

Snowflake.Data has weak temporary files permissions

Issue Snowflake discovered and remediated a vulnerability in the Snowflake Connector for .NET in which files downloaded from stages are temporarily placed in a world-readable local directory, making them accessible to unauthorized users on the same machine. This vulnerability affects versions...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview twig/twig is a flexible, fast, and secure template language for PHP. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' due to improper handling of the null coalesce operator ??. This is...

[SECURITY] [DLA 4034-1] simgear security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4034-1 [email protected] https://www.debian.org/lts/security/ Dr. Tobias Quathamer January 29, 2025 https://wiki.debian.org/LTS -...

PT-2025-4066

Name of the Vulnerable Software and Affected Versions GNU Binutils versions up to 2.43 Description A problematic issue was found in GNU Binutils, affecting the disassemble bytes function of the file binutils/objdump.c. The manipulation of the buf argument leads to a stack-based buffer overflow. I...

Debian dla-4035 : flightgear - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4035 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4035-1 [email protected] https://www.debian.org/lts/security/...

PT-2025-5569 · Snowflake · Snowflake-Connector-Net

Name of the Vulnerable Software and Affected Versions: snowflake-connector-net versions 2.0.12 through 4.2.0 Description: The issue arises when files downloaded from stages are temporarily placed in a world-readable local directory, making them accessible to unauthorized users on the same machine...

PT-2025-5571 · Snowflake · Snowflake Jdbc Driver

Name of the Vulnerable Software and Affected Versions: Snowflake JDBC Driver versions 3.6.8 through 3.21.0 Description: The Snowflake JDBC Driver has a vulnerability that affects Linux systems when temporary credential caching is enabled. In this scenario, the driver caches temporary credentials...