Fedora 42 : python3.9 (2025-6efe030226)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-6efe030226 advisory. Update to 3.9.23. - gh-135034: CVE 2024-12718 CVE 2025-4138 CVE 2025-4330 CVE 2025-4435 CVE 2025-4517 Fixes multiple issues that allowed tarfile extraction...

CVE-2025-40914

Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow. CryptX embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328...

PT-2025-30012

Name of the Vulnerable Software and Affected Versions Grafana versions 11.3.8 through 11.6.3 Grafana versions 11.4.6 through 11.5.6 Grafana versions 11.5.0 through 11.5.6 Grafana versions prior to 12.0.2+security-01 Grafana versions prior to 1.9.2-0.20250521205822-0ba0b99665a9 Description Grafana...

CVE-2025-49133

Libtpms is a library that targets the integration of TPM functionality into hypervisors, primarily into Qemu. Libtpms, which is derived from the TPM 2.0 reference implementation code published by the Trusted Computing Group, is prone to a potential out of bounds OOB read vulnerability. The...

Description of the security update for Word 2016: June 10, 2025 (KB5002710)

None None...

PT-2025-24993 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.22 and earlier Description: The issue is a stored Cross-Site Scripting XSS vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. When ...

PT-2025-25161 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.22 and earlier Description: The issue is a stored Cross-Site Scripting XSS vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. When ...

PT-2025-24848 · Microsoft · Windows Storage Management Provider +1

Name of the Vulnerable Software and Affected Versions: Windows Storage Management Provider affected versions not specified Description: The issue is an out-of-bounds read in the Windows Storage Management Provider, allowing an authorized attacker to disclose information locally. Recommendations: ...

Important: nodejs20

Issue Overview: Corrupted pointer in node::fs::ReadFileUtf8const FunctionCallbackInfo& args when args0 is a string, resulting in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service. Info:...

CVE-2025-5915

A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber LZSS window. This means the library may attempt to read beyond the allocated memory buffer, which can...

Slackware Linux 15.0 / current libvpx Vulnerability (SSA:2025-159-01)

The version of libvpx installed on the remote host is prior to 1.12.0 / 1.15.2. It is, therefore, affected by a vulnerability as referenced in the SSA:2025-159-01 advisory. New libvpx packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted the precedin...

PT-2025-24163 · WordPress · Responsify Wp

Name of the Vulnerable Software and Affected Versions: Responsify WP versions 1.9.11 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-24127 · Unknown · Mangup Personal Favicon

Name of the Vulnerable Software and Affected Versions: mangup Personal Favicon versions n/a through 2.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application...

PT-2025-24088 · Unknown · Daman Jeet Real Time Validation For Gravity Forms

Name of the Vulnerable Software and Affected Versions: Daman Jeet Real Time Validation for Gravity Forms versions 1.7.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS...

Fedora 42 : seamonkey (2025-de559644ca)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-de559644ca advisory. Update to 2.53.21 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

CVE-2025-49008

Atheos is a self-hosted browser-based cloud integrated development environment. Prior to version 6.0.4, improper use of escapeshellcmd in /components/codegit/traits/execute.php allows argument injection, leading to arbitrary command execution. Atheos administrators and users of vulnerable version...

PT-2025-23852 · Freshrss · Freshrss

Name of the Vulnerable Software and Affected Versions: FreshRSS versions prior to 1.26.2 Description: A vulnerability in FreshRSS, a self-hosted RSS feed aggregator, causes a user to be repeatedly logged out after fetching a malicious feed entry, effectively resulting in denial of service...

SUSE: Security Advisory (SUSE-SU-2024:4295-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

perl-Crypt-OpenSSL-RSA-0.350.0-1.1 on GA media (moderate)

perl-Crypt-OpenSSL-RSA-0.350.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:15199-1 Rating: moderate Cross-References: CVE-2024-2467 CVSS scores: CVE-2024-2467 SUSE : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Tumbleweed An update that solves one vulnerabili...

CVE-2025-4435

When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not skipped...