RHSA-2025:11245 Red Hat Security Advisory: kernel security update

Bulletin has no description...

CVE-2025-53027

CVE-2025-53027 affects Oracle VM VirtualBox 7.1.10 (Core). Local attacker with logon can compromise Oracle VM VirtualBox; high impact to confidentiality, integrity and availability (CVSS v3.1 base 8.2). Root cause described as an issue in VirtualBox Core; exploitation details are not provided in ...

CVE-2025-50081

CVE-2025-50081 affects Oracle MySQL Client: mysqldump. Affected versions include 8.0.0–8.0.42, 8.4.0–8.4.5 and 9.0.0–9.3.0. The vulnerability is exploitable by a high-privilege attacker with network access via multiple protocols; exploitation requires user interaction. Impact is limited to confid...

CVE-2025-30743

CVE-2025-30743 affects Oracle E-Business Suite Oracle Lease and Finance Management, component Internal Operations , with affected version 12.2.13 . The vulnerability allows a low-privileged attacker with network access via HTTP to compromise the system, potentially enabling unauthorized creation,...

CVE-2025-53861

A flaw was found in Ansible. Sensitive cookies without security flags over non-encrypted channels can lead to Man-in-the-Middle MitM and Cross-site scripting XSS attacks allowing attackers to read transmitted data. Mitigation Currently, there is no mitigation available for this vulnerability...

CVE-2025-38317

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix buffer overflow in debugfs If the user tries to write more than 32 bytes then it results in memory corruption. Fortunately, this is debugfs so it's limited to root users...

CVE-2025-7370

A flaw was found in libsoup. A NULL pointer dereference vulnerability occurs in libsoup's cookie parsing functionality. When processing a cookie without a domain parameter, the soupcookiejaraddcookie function will crash, resulting in a denial of service. Mitigation Currently, no mitigation is...

CVE-2025-6491

A vulnerability was found in PHP. If a SoapVar instance is created with a fully qualified name larger than 2G, this will cause a NULL pointer dereference resulting in a segmentation fault, leading to a denial of service. Mitigation Currently, no mitigation is currently available for this...

Schneider Electric System Monitor Application

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...

openh264: Heap Overflow

Background OpenH264 is a codec library which supports H.264 encoding and decoding. It is suitable for use in real time applications such as WebRTC. Description A vulnerability has been discovered in openh264. Please review the CVE identifiers referenced below for details. Impact A vulnerability i...

PT-2025-28169 · Unknown · Campcodes Payroll Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Payroll Management System version 1.0 Description: A critical issue was found in the system, affecting an unknown functionality of the file /ajax.php?action=save employee attendance. The manipulation of the employee id argument lead...

PT-2025-27803 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 15.03.05.16 multi Description: The issue concerns a Buffer Overflow in the formSetQosBand function via the list parameter. This occurs in the context of QoS configuration. Recommendations: For Tenda AC6 version 15.03.05.16...

CVE-2025-5731

A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found. Mitigation Currently, no mitigation is available for this...

RHSA-2025:9581 Red Hat Security Advisory: kernel-rt security update

Bulletin has no description...

CVE-2025-6557

A data validation flaw has been discovered in Chromium. An attacker who is able to convince a user to engage in specific UI gestures may be able to exploit this vulnerability via a crafted HTML page. Mitigation Mitigation for this issue is either not available or the currently available options d...

From Patching to Eliminating Risk: What’s new in TruRisk™ Eliminate and Patch Management

As IT and security priorities converge under rising pressure, patch management is no longer just a hygiene activity but a strategic tool to eliminate the risk from exposed vulnerabilities. Since the last major release cycle, we’ve been expanding the Qualys Patch Management solution into a broader...

CVE-2025-5416

A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure. While it requires an already authenticated user, the /admin/serverinfo endpoint can inadvertently provide sensitive environment information. Mitigation Currently, no mitigation is available for...

CVE-2025-23173

The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the websockify service is exposed on port 6080 and accessible from the internet. This exposure introduces significant risk, as websockify has known...

CVE-2025-6087

A Server-Side Request Forgery SSRF vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /next/image endpoint...

PT-2025-25720 · WordPress · Wp Views Counter

Name of the Vulnerable Software and Affected Versions: WP Views Counter versions n/a through 2.0.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attacker can injec...