PT-2025-16923 · Veritas +1 · Arctera/Veritas Data Insight +1

Name of the Vulnerable Software and Affected Versions: Arctera/Veritas Data Insight versions prior to 7.1.2 Description: The issue concerns the transmission of cleartext credentials when Arctera/Veritas Data Insight is configured to use HTTP Basic Authentication to a Dell Isilon OneFS server...

PT-2025-16571 · Mattermost · Mattermost Server +1

Name of the Vulnerable Software and Affected Versions: Mattermost Plugin MSTeams versions prior to 2.1.0 Mattermost Server versions 10.5.x through 10.5.1 Description: The issue allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack during webhook secret...

AlmaLinux 9 : gvisor-tap-vsock (ALSA-2025:3833)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2025:3833 advisory. golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh CVE-2025-22869 Tenable has extracted the preceding description block...

PT-2025-16613

Name of the Vulnerable Software and Affected Versions Essential Addons for Elementor versions n/a through 6.1.9 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker...

CVE-2025-30691

Vulnerability in Oracle Java SE component: Compiler. Supported versions that are affected are Oracle Java SE: 21.0.6, 24; Oracle GraalVM for JDK: 21.0.6 and 24. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java...

CVE-2025-3523

When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from...

PT-2025-16319 · Jetpopup · Jetpopup

Name of the Vulnerable Software and Affected Versions: JetPopup versions n/a through 2.0.11 Description: The issue is related to a Missing Authorization vulnerability in JetPopup, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions n/a through...

PT-2025-16512 · Loos · Arkhe

Name of the Vulnerable Software and Affected Versions: LOOS, Inc. Arkhe versions n/d through 3.11.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows PHP Local File Inclusion. This means an attacker could potentially force a user to perform unintende...

PT-2025-16432

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u441, 8u441-perf, 11.0.26, 17.0.14, 21.0.6, 24 Oracle GraalVM for JDK versions 17.0.14, 21.0.6, 24 Oracle GraalVM Enterprise Edition versions 20.3.17, 21.3.13 Description A difficult to exploit vulnerability in the...

CVE-2025-32910

A flaw was found in libsoup, where soupauthdigestauthenticate is vulnerable to a NULL pointer dereference. This issue may cause the libsoup client to crash...

Azure Linux 3.0 Security Update: python-setuptools / python3 (CVE-2024-6345)

The version of python-setuptools / python3 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-6345 advisory. - A vulnerability in the packageindex module of pypa/setuptools versions up to 69.1.1 allo...

MGASA-2025-0133 Updated gnupg2 packages fix security vulnerability

In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS". CVE-2025-30258...

CVE-2025-32807

A path traversal vulnerability in FusionDirectory before 1.5 allows remote attackers to read arbitrary files on the host that end with .png and .svg or .xpm for some configurations via the icon parameter of a GET request to geticon.php...

Huawei EulerOS: Security Advisory for python-jinja2 (EulerOS-SA-2025-1376)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-32699

Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid.This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1; Parsoid: before 0.16.5, 0.19.2, 0.20.2...

PT-2025-15951 · Unknown · Asgaros Forum

Name of the Vulnerable Software and Affected Versions: Asgaros Forum versions 3.0.0 and earlier Description: The issue allows Identity Spoofing through an Authentication Bypass by Spoofing vulnerability. Recommendations: For Asgaros Forum versions 3.0.0 and earlier, update to a version that fixes...

CVE-2025-21863 affecting package kernel for versions less than 6.6.82.1-1

CVE-2025-21863 affecting package kernel for versions less than 6.6.82.1-1. An upgraded version of the package is available that resolves this issue...

PT-2025-15808

Name of the Vulnerable Software and Affected Versions: Elementor One Click Accessibility versions n/a through 3.1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

PT-2025-15779 · Unknown · Sudavar Codescar Radio Widget

Name of the Vulnerable Software and Affected Versions: Sudavar Codescar Radio Widget versions 0.4.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

CVE-2024-52980

A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elasticsearch node to crash. A successful attack requires a malicious user to have readpipeline Elasticsearch cluster privilege assigned to the...