AlmaLinux 8 : glibc (ALSA-2025:8686)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:8686 advisory. glibc: static setuid binary dlopen may incorrectly search LDLIBRARYPATH CVE-2025-4802 Tenable has extracted the preceding description block directly from the...

CVE-2025-47089

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brow...

CVE-2025-43574

Adobe Acrobat Reader (DC/Continuous and 2020) versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by CVE-2025-43574, a Use After Free vulnerability that could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction (opening ...

CVE-2025-33069

CVE-2025-33069 affects Windows App Control for Business (WDAC). The root cause is improper verification of cryptographic signatures in WDAC, enabling a local attacker to bypass the security feature. The vulnerability is categorized as a security feature bypass with medium severity (CVSS 3.1: Loca...

CVE-2025-4653

Improper Neutralization of Special Elements in the backup name field may allow OS command injection. This issue affects Pandora ITSM 5.0.105...

CVE-2025-49509

CVE-2025-49509 (Audio Editor & Recorder by Roland Beaussant) is a Missing Authorization vulnerability in Audio Editor & Recorder up to version 2.2.1. The issue stems from incorrectly configured access control security levels, enabling exploitation of unauthorized access to protected functionality...

AIX is vulnerable to an expected behavior violation (CVE-2025-32728) due to OpenSSH

IBM SECURITY ADVISORY First Issued: Tue Jun 10 08:33:35 CDT 2025 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/opensshadvisory19.asc Security Bulletin: AIX is vulnerable to an expected behavior violation CVE-2025-32728 due to OpenSSH...

CVE-2025-49651 Missing Authorization for Interactive Sessions

Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the session. This vulnerability exists in all current versions of BackendAI...

CVE-2025-31061

CVE-2025-31061 describes a reflected XSS in the WordPress Wishlist (Wishlist – WordPress plugin) affecting versions from n/a up to 2.1.0. The issue arises from improper neutralization of input during web page generation, enabling an attacker to inject arbitrary scripts via user-supplied input tha...

Security Bulletin: IBM Rhapsody Systems Engineering is using next-14.2.15.tgz which is vulnerable to CVE-2024-56332

Summary A security vulnerability was identified in the Next.js package used in our product. We have resolved the issue by updating to a non-vulnerable patched version to ensure the continued security and reliability of our application. Following IBM® Engineering Lifecycle Engineering product is...

RHEL 8 : mod_security (RHSA-2025:8626)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8626 advisory. ModSecurity is an open source intrusion detection and prevention engine for web applications. Security Fixes: modsecurity: ModSecurity Has Possible D...

CVE-2025-30636

Missing Authorization vulnerability in Ability, Inc Accessibility Suite online-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Suite: from n/a through = 4.19...

CVE-2025-49288

Missing Authorization vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Authentication Bypass.This issue affects Ultimate WP Mail: from n/a through = 1.3.5...

CVE-2025-49442

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Mostafa Shahiri Simple Nested Menu simple-nested-menu allows Stored XSS.This issue affects Simple Nested Menu: from n/a through = 1.0...

CVE-2025-49619

Skyvern through 0.1.85 is vulnerable to server-side template injection SSTI in the Prompt field of workflow blocks such as the Navigation v2 Block. Improper sanitization of Jinja2 template input allows authenticated users to inject crafted expressions that are evaluated on the server, leading to...

WordPress Domain For Sale plugin <= 3.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via class_name Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via classname Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Domain For Sale versions = 3.0.10...

WordPress Audio Editor & Recorder plugin <= 2.2.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by theviper17 Patchstack Alliance in WordPress Plugin Audio Editor & Recorder versions = 2.2.1...

CVE-2025-49288

Missing Authorization vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Authentication Bypass.This issue affects Ultimate WP Mail: from n/a through = 1.3.5...

CVE-2025-23969

CVE-2025-23969 is reported for KI Live Video Conferences (via RH: CVE-2025-23969) and concerns Exposure of Sensitive System Information to an Unauthorized Actor . The Red Hat entry mirrors the description: it affects KI Live Video Conferences (version range: n/a up to 5.5.15) and enables retrieva...

WordPress Simple Google Static Map plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Chu The Anh Blue Rock in WordPress Plugin Simple Google Static Map versions = 1.0.1...