Konsole: Code execution

Background Konsole is KDE's terminal emulator. Description Konsole supports loading URLs from the scheme handlers such as telnet://URL. This can be executed regardless of whether the telnet binary is available. It would fallback to bash in that case and execute arbitrary code. Impact Clicking a...

GHSA-59W6-R9HM-439H XWiki does not require right warnings for XClass definitions

Impact When an attacker without script or programming right creates an XClass definition in XWiki requires edit right, and that same document is later edited by a user with script, admin, or programming right, malicious code could be executed with the rights of the editing user without prior...

PT-2025-25455 · Ibm · Ibm Backup

Name of the Vulnerable Software and Affected Versions: IBM Backup, Recovery and Media Services for i versions 7.4 through 7.5 Description: The issue allows a user with the capability to compile or restore a program to gain elevated privileges due to a library unqualified call made by a BRMS...

CVE-2025-27505

GeoServer is an open source server that allows users to share and edit geospatial data. It is possible to bypass the default REST API security and access the index page. The REST API security handles rest and its subpaths but not rest with an extension e.g., rest.html. The REST API index can...

PT-2025-25334

Name of the Vulnerable Software and Affected Versions InstallShield versions 2021 R2 through 2023 R2 Description A potential elevated privilege issue has been reported with InstallShield built Standalone MSI setups having multiple InstallScript custom actions configured. Recommendations For...

Emacs: Multiple Vulnerabilities

Background Emacs is the extensible, customizable, self-documenting real-time display editor. org-mode is an Emacs mode for notes and project planning. Description Multiple vulnerabilities have been discovered in Emacs, org-mode. Please review the CVE identifiers referenced below for details. Impa...

Qt: Multiple Vulnerabilities

Background Qt is a cross-platform application development framework. Description Multiple vulnerabilities have been discovered in Qt. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known...

PT-2025-25332

Name of the Vulnerable Software and Affected Versions Tenda AC6 version 15.03.05.16 Description A Buffer Overflow issue allows a remote attacker to cause a denial of service via the oversized schedStartTime and schedEndTime parameters in an unauthenticated HTTP GET request to the...

PT-2025-25329 · Unknown · Uptrace Pgdriver

Name of the Vulnerable Software and Affected Versions: uptrace pgdriver version 1.2.1 Description: The issue is related to a SQL injection vulnerability. It is caused by the appendArg function in /pgdriver/format.go. Recommendations: For uptrace pgdriver version 1.2.1, consider disabling the...

GStreamer, GStreamer Plugins: Multiple Vulnerabilities

Background GStreamer is an open source multimedia framework. Description Multiple vulnerabilities have been discovered in GStreamer, GStreamer Plugins. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There...

GTK+ 3: Search path vulnerability

Background GTK+ GIMP Toolkit + is a toolkit for creating graphical user interfaces. Description A vulnerability has been discovered in GTK+ 3. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifier for details. Workaround There is no kno...

Medium: python-tornado

Issue Overview: Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume ...

Amazon Linux 2023 : ecs-init (ALAS2023-2025-1015)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1015 advisory. containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a UID:GID larger than the maximum...

Security Bulletin: Erlang/OTP SSH Protocol Flaw Allows Remote Code Execution

Summary Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution RCE. By exploiting a flaw in SSH protocol message handling, a malicious...

pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration

Impact When the PostgreSQL JDBC driver is configured with channel binding set to required default value is prefer, the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding such as password, MD5, GSS, or SSPI authentication. This cou...

CVE-2025-49006

Wasp Web Application Specification is a Rails-like framework for React, Node.js, and Prisma. Prior to version 0.16.6, Wasp authentication has a vulnerability in the OAuth authentication implementation affecting only Keycloak with a specific config. Wasp currently lowercases OAuth user IDs before...

GHSA-WJW6-95H5-4JPX Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating

Impact What kind of vulnerability is it? Who is impacted? All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot: 1. A malicious...

GeoServer Missing Authorization on REST API Index

Summary It is possible to bypass the default REST API security and access the index page. Details The REST API security handles rest and its subpaths but not rest with an extension e.g., rest.html. Impact The REST API index can disclose whether certain extensions are installed. Workaround In...

CVE-2025-27505 GeoServer Missing Authorization on REST API Index

GeoServer is an open source server that allows users to share and edit geospatial data. It is possible to bypass the default REST API security and access the index page. The REST API security handles rest and its subpaths but not rest with an extension e.g., rest.html. The REST API index can...

CVE-2025-27505

GeoServer contains a REST API index authorization bypass vulnerability (CVE-2025-27505). The REST security excludes paths with extensions (for example rest.html), allowing unauthenticated access to the REST API Index and potentially revealing installed extensions and API endpoints. Affected codep...