What needs attention now.

asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation

• asVereinbase
• Authentication bypass

Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace

• codexonics Prime Mover – Backup and Migration
• Insecure deserialization

Arbitrary file read and backend crash through unrestricted provider method calls

• GitroomHQ postiz-app
• Path traversal
• Code injection

Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

• Memory corruption

<13.0.0 · fixed in 13.0.0

Laravel TokenGuard authentication bypass through non-string API credentials

• Authentication bypass
• CWE-1287

<12.68.0 || >=13.0.0, <13.29.0 · fixed in 12.68.0, 13.29.0

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

• HTTP request smuggling
• Broken access control

>=4.0.0, <4.16.1 · fixed in 4.16.1

Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server

• AWS multi-model-server
• Path traversal

obsidian-tc tokens can access arbitrary configured vaults

• Broken access control

<1.3.1 · fixed in 1.3.1

Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKEN

• conda infrastructure
• Code injection

Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS

• intranda goobi-viewer-core
• Cross-site scripting (XSS)
• Other injection

Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer

• intranda goobi-viewer-core
• Path traversal

Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer

• intranda goobi-viewer-core
• Authentication bypass
• Information disclosure

odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)

• openwrt odhcpd
• Memory corruption

WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability

• AivahThemes Hostme v2
• Insecure deserialization

WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability

• axiomthemes Holistic Center
• Insecure deserialization

WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability

• ThemeREX ZenSoul
• Insecure deserialization

WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability

• ThemeREX Group Save Life
• Insecure deserialization

WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability

• ThemeREX Group HotLock
• Insecure deserialization

WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability

• axiomthemes Hallelujah
• Insecure deserialization

WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability

• ThemeREX Group Vagabonds
• Insecure deserialization

WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability

• axiomthemes Reprizo
• Insecure deserialization

WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability

• axiomthemes Rhodos
• Insecure deserialization

WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability

• ThemeREX Group Little Birdies
• Insecure deserialization

WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability

• axiomthemes Redy
• Insecure deserialization

net/mlx5e: Prevent stale XSK buffer release on refill retry

• Linux kernel

net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry

• Linux kernel

btrfs: fix xattr replace when multiple xattrs are packed in the same item

• Linux kernel

AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_server

• Fosowl AgenticSeek
• CWE-489

WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers

• Weak cryptography or TLS

>=1.9.0, <1.29.0 · fixed in 1.29.0

bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop

• Hallo Welt! GmbH BlueSpice
• Privilege escalation
• CWE-1188

Local Privilege Escalation in CGM CLININET

• CGM CLININET
• Broken access control

Remote Code Execution in CGM CLININET

• CGM CLININET
• Code injection

Remote Code Execution via Java Deserialization in CGM CLININET

• CGM CLININET
• Insecure deserialization

Remote Code Execution in CGM CLININET

• CGM CLININET
• Privilege escalation

WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability

• xnau webdesign Participants Database
• SQL injection

WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability

• xnau webdesign Participants Database
• Insecure deserialization

Authentication Bypass Vulnerability

• WizLearn Technologies Pte. Ltd. Learning Management System
• Authentication bypass

Firmware verification vulnerability

• Creative Labs Creative Sound Blaster Katana V2, V2X, SE
• CWE-494

Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action

• Advanced Custom Fields: Extended
• Advanced Custom Fields: Extended PRO
• Code injection

Part-DB: Authenticated RCE via .phar attachment upload served from public/media

• Part-DB-server
• Unrestricted file upload

Command Execution via Admin Console Input in Okta Access Gateway

• Okta Access Gateway
• Code injection
• CWE-20

Authentication Bypass Leading to Server-Side Command Execution

• onPhase Forms
• Authentication bypass

Kiloview E3 NDI Encoder OS Command Injection

• Kiloview E3 Firmware
• Command injection

Kiloview E3 NDI Encoder OS Command Injection

• Kiloview E3 Firmware
• Command injection

Kiloview E3 NDI Encoder OS Command Injection

• Kiloview E3 Firmware
• Command injection

VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability

• Microsoft VM Inspector for Azure Virtual Machines
• Path traversal

Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability

• Microsoft Azure Kubernetes Configuration Service
• Authentication bypass

AAD App Proxy Elevation of Privilege Vulnerability

• Microsoft Entra application proxy
• Authentication bypass

Azure Pipelines Remote Code Execution Vulnerability

• Microsoft Azure Pipelines
• Command injection

InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive Information

• InterSystems IRIS for Health
• Weak cryptography or TLS

Security Advisory 0199

• Arista Networks VeloCloud Orchestrator
• SQL injection

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream

• lxc incus
• Path traversal

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes

• lxc incus
• Path traversal

Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options

• lxc incus
• Command injection

Mistune before 3.3.0 Path Traversal via include Directive

• lepture mistune
• Path traversal

Unauthenticated Adjacent Sensitive Information Disclosure in AOS-10 Wi-Fi Frame Processing

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Information disclosure

Authentication Bypass in the PAPI Protocol of AOS-8 Allows Unauthorized Administrative Access

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Authentication bypass

Authentication Bypass in the API allows Administrative Access of AOS-10

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Authentication bypass

Unauthenticated Adjacent Authentication Bypasses in the PAPI Protocol of AOS-10 Leads to Unauthorized Administrative Access

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Authentication bypass

Unauthenticated Buffer Overflow Vulnerability allows Remote Code Execution in AOS-10 and AOS-8

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Memory corruption