⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Automatically generated suggestions

Create Draft to queue a suggestion for refinement.

Dismiss to remove a suggestion from the queue.

CVE-2025-32230
4.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 4 months, 3 weeks ago
WordPress Tutor LMS plugin <= 3.4.0 - HTML Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Tutor LMS. This issue affects Tutor LMS: from n/a through 3.4.0.

tutor
=<3.4.0

pkgs.haskellPackages.timeless-tutorials

Initial project template from stack
CVE-2025-23386
7.8 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 4 months, 3 weeks ago
gerbera: Privilege escalation from user gerbera to root because of insecure %post script

A Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed package gerbera allows the service user gerbera to escalate to root.,This issue affects gerbera on openSUSE Tumbleweed before 2.5.0-1.1.

gerbera
<2.5.0-1.1
Package maintainers: 1
CVE-2025-31002
9.1 CRITICAL
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): HIGH
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 4 months, 3 weeks ago
WordPress Squeeze plugin <= 1.6 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Bogdan Bendziukov Squeeze allows Using Malicious Files. This issue affects Squeeze: from n/a through 1.6.

squeeze
=<1.6

pkgs.postgresqlPackages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.python311Packages.pysqueezebox

Asynchronous library to control Logitech Media Server

pkgs.python312Packages.pysqueezebox

Asynchronous library to control Logitech Media Server

pkgs.postgresql13Packages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.postgresql14Packages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.postgresql15Packages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.postgresql16Packages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.postgresql17Packages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.postgresqlJitPackages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.postgresql13JitPackages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.postgresql14JitPackages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.postgresql15JitPackages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.postgresql16JitPackages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.postgresql17JitPackages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.home-assistant-component-tests.squeezebox

Open source home automation that puts local control and privacy first

pkgs.python312Packages.pysqueezebox.x86_64-linux

Asynchronous library to control Logitech Media Server

pkgs.python312Packages.pysqueezebox.aarch64-linux

Asynchronous library to control Logitech Media Server

pkgs.python312Packages.pysqueezebox.x86_64-darwin

Asynchronous library to control Logitech Media Server

pkgs.python312Packages.pysqueezebox.aarch64-darwin

Asynchronous library to control Logitech Media Server
Package maintainers: 5
CVE-2025-31003
2.7 LOW
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): HIGH
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 4 months, 3 weeks ago
WordPress Squeeze plugin <= 1.6 - Full Path Disclosure (FPD) vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bogdan Bendziukov Squeeze allows Retrieve Embedded Sensitive Data. This issue affects Squeeze: from n/a through 1.6.

squeeze
=<1.6

pkgs.postgresqlPackages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.python311Packages.pysqueezebox

Asynchronous library to control Logitech Media Server

pkgs.python312Packages.pysqueezebox

Asynchronous library to control Logitech Media Server

pkgs.postgresql13Packages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.postgresql14Packages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.postgresql15Packages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.postgresql16Packages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.postgresql17Packages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.postgresqlJitPackages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.postgresql13JitPackages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.postgresql14JitPackages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.postgresql15JitPackages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.postgresql16JitPackages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.postgresql17JitPackages.pg_squeeze

PostgreSQL extension for automatic bloat cleanup

pkgs.home-assistant-component-tests.squeezebox

Open source home automation that puts local control and privacy first

pkgs.python312Packages.pysqueezebox.x86_64-linux

Asynchronous library to control Logitech Media Server

pkgs.python312Packages.pysqueezebox.aarch64-linux

Asynchronous library to control Logitech Media Server

pkgs.python312Packages.pysqueezebox.x86_64-darwin

Asynchronous library to control Logitech Media Server

pkgs.python312Packages.pysqueezebox.aarch64-darwin

Asynchronous library to control Logitech Media Server
Package maintainers: 5
CVE-2023-4320
7.6 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): HIGH
  • Availability impact (A): LOW
created 4 months, 3 weeks ago
Satellite: arithmetic overflow in satellite

An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to create personal access tokens that are valid indefinitely, resulting in damage to the system's integrity.

foreman
*
Security

pkgs.foreman

Process manager for applications with multiple components
Package maintainers: 1
CVE-2025-32584
7.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 4 months, 3 weeks ago
WordPress Chat2 plugin <= 3.6.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Chat2 Chat2 allows Cross Site Request Forgery. This issue affects Chat2: from n/a through 3.6.3.

chat2
=<3.6.3
Package maintainers: 1
CVE-2023-4886
6.7 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): HIGH
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 4 months, 3 weeks ago
Foreman: world readable file containing secrets

A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and truststore, were found to be world readable.

foreman
*
foreman-installer
*

pkgs.foreman

Process manager for applications with multiple components
Package maintainers: 1
CVE-2024-2496
5.0 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 4 months, 3 weeks ago
Libvirt: null pointer dereference in udevconnectlistallinterfaces()

A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.

libvirt
*
<9.7.0
virt:av/libvirt
virt:rhel/libvirt

pkgs.libvirt

Toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes

pkgs.libvirt-glib

Library for working with virtual machines

pkgs.libvirt.x86_64-linux

Toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes

pkgs.libvirt.aarch64-linux

Toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes

pkgs.libvirt.x86_64-darwin

Toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes

pkgs.libvirt.aarch64-darwin

Toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes

pkgs.libvirt-glib.x86_64-linux

Library for working with virtual machines

pkgs.rubyPackages.ruby-libvirt

pkgs.libvirt-glib.aarch64-linux

Library for working with virtual machines

pkgs.libvirt-glib.x86_64-darwin

Library for working with virtual machines

pkgs.libvirt-glib.aarch64-darwin

Library for working with virtual machines

pkgs.prometheus-libvirt-exporter

Prometheus metrics exporter for libvirt

pkgs.terraform-providers.libvirt

pkgs.rubyPackages_3_1.ruby-libvirt

pkgs.rubyPackages_3_2.ruby-libvirt

pkgs.rubyPackages_3_3.ruby-libvirt

pkgs.rubyPackages_3_4.ruby-libvirt

pkgs.python312Packages.libvirt.x86_64-linux

libvirt Python bindings

pkgs.python312Packages.libvirt.aarch64-linux

libvirt Python bindings

pkgs.python312Packages.libvirt.x86_64-darwin

libvirt Python bindings

pkgs.python312Packages.libvirt.aarch64-darwin

libvirt Python bindings

pkgs.rubyPackages_3_1.ruby-libvirt.x86_64-linux

pkgs.rubyPackages_3_2.ruby-libvirt.x86_64-linux

pkgs.rubyPackages_3_3.ruby-libvirt.x86_64-linux

pkgs.rubyPackages_3_4.ruby-libvirt.x86_64-linux

pkgs.rubyPackages_3_1.ruby-libvirt.aarch64-linux

pkgs.rubyPackages_3_1.ruby-libvirt.x86_64-darwin

pkgs.rubyPackages_3_2.ruby-libvirt.aarch64-linux

pkgs.rubyPackages_3_2.ruby-libvirt.x86_64-darwin

pkgs.rubyPackages_3_3.ruby-libvirt.aarch64-linux

pkgs.rubyPackages_3_3.ruby-libvirt.x86_64-darwin

pkgs.rubyPackages_3_4.ruby-libvirt.aarch64-linux

pkgs.rubyPackages_3_4.ruby-libvirt.x86_64-darwin

pkgs.rubyPackages_3_1.ruby-libvirt.aarch64-darwin

pkgs.rubyPackages_3_2.ruby-libvirt.aarch64-darwin

pkgs.rubyPackages_3_3.ruby-libvirt.aarch64-darwin

pkgs.rubyPackages_3_4.ruby-libvirt.aarch64-darwin

Package maintainers: 4
CVE-2025-31375
7.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 4 months, 3 weeks ago
WordPress Scheduled plugin <= 1.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in bhoogterp Scheduled allows Stored XSS. This issue affects Scheduled: from n/a through 1.0.

scheduled
=<1.0

pkgs.azure-cli-extensions.scheduled-query

Microsoft Azure Command-Line Tools Scheduled_query Extension
Package maintainers: 2
CVE-2023-23457
5.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 4 months, 4 weeks ago
Upx: segv on packlinuxelf64::invert_pt_dynamic() in p_lx_elf.cpp

A Segmentation fault was found in UPX in PackLinuxElf64::invert_pt_dynamic() in p_lx_elf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service.

upx
*

pkgs.upx

Ultimate Packer for eXecutables