Bundesamt für Sicherheit in der Informationstechnik vulnerabilities and threats

A vulnerability has been identified in IBM WebSphere Application Server Liberty that allows bypassing security controls. The product is a J2EE application server. No specific affected versions or detailed technical information are provided.

Multiple vulnerabilities have been identified in BusyBox versions 1.36.1 and 1.37.0. BusyBox is a software that combines various standard Unix utilities into a single executable. Red Hat has issued a security advisory addressing these vulnerabilities with updated RPM packages for their Hardened Images. Public exploit code is available, but no active exploitation in the wild has been reported.

Multiple vulnerabilities have been identified in Grafana, an analytics and visualization software. These issues affect versions prior to 12.3.2+security-01 and the specific 12.3.2+security-01 version. A fixed version 12.3.2+security-01 is available to address these vulnerabilities.

Multiple vulnerabilities have been identified in Django, a Python-based server-side web framework. These include SQL injection and denial of service issues via crafted inputs and parameters. The vulnerabilities affect Django versions used within the Python 3.11 environment as packaged for Red Hat Ansible Automation Platform. Red Hat has issued security advisories and updates addressing these issues.

A vulnerability identified as CVE-2025-14914 affects IBM WebSphere Application Server Liberty, a J2EE application server. The vulnerability potentially allows code execution. No specific affected versions or CVSS score are provided.

Multiple vulnerabilities affecting Next.js components used in Red Hat Streams for Apache Kafka 3.2.0 can lead to denial of service conditions. These issues include denial of service via specially crafted HTTP requests targeting React Server Components. The vulnerabilities are part of a broader set of security fixes in Red Hat Streams for Apache Kafka 3.2.0, which addresses various security and bug issues across components including Next.js, Netty, Axios, lodash, and others.

Multiple security vulnerabilities have been identified in Grafana, an open-source analytics and visualization software. These include issues such as denial of service due to excessive resource consumption via crafted certificates, dashboard permissions scope bypass enabling cross-dashboard privilege escalation, excessive CPU consumption during archive index building, memory exhaustion in query parameter parsing, and unexpected session resumption in TLS. A security update addressing these vulnerabilities is available in Grafana version 12.3.1+security-01.

Multiple vulnerabilities in the libpng library's simplified API can cause denial of service (DoS) by crashing the library when processing specially crafted PNG files. These issues involve incorrect handling of palette PNG images with partial transparency and gamma correction, interlaced 16-bit PNGs with 8-bit output format and non-minimal row strides, invalid row strides, and quantizing RGB images. The vulnerabilities affect various Ubuntu releases and have been addressed through package updates.

Multiple security vulnerabilities have been identified in Red Hat build of Quarkus versions 3.20.4.SP1 and 3.27.1.SP1. These include information disclosure and denial of service issues in the lz4-java library, as well as a cross-site scripting vulnerability in Eclipse Vert.x web component. Red Hat has released security updates addressing these issues with an important security impact rating.

A vulnerability in NetApp Data ONTAP, the operating system for NetApp storage products, has been identified that allows for a denial of service condition. The affected versions include 9.17.1 and later. No CVSS score or detailed technical information is provided. There is no indication of known exploits in the wild or available patches at this time.

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.20 allow denial of service conditions due to issues in Helm chart processing. Red Hat has released version 4.20.6 to address these flaws with a security impact rated as Moderate. Users of OpenShift Container Platform 4.20 are advised to upgrade to the fixed release to mitigate these vulnerabilities.

Flowise, an open-source user interface for creating Large Language Models (LLMs), has multiple vulnerabilities that allow attackers to bypass security measures. These issues affect versions prior to 3.0.10. A fix addressing these vulnerabilities is available in version 3.0.10.

Strongswan ist eine IPSec-basierte VPN Implementierung.

A vulnerability identified as CVE-2025-9951 affects FFmpeg versions prior to 8.0, specifically in the JPEG 2000 decoder where improper memory handling can lead to a heap buffer overflow. This flaw could allow an attacker to cause a denial of service or potentially leak sensitive information by tricking a user or application into opening a specially crafted media file. The issue is part of a broader set of FFmpeg vulnerabilities addressed in recent security advisories. Official patches are available through Ubuntu Pro via Extended Security Maintenance (ESM) for multiple Ubuntu LTS releases. Users are advised to update their FFmpeg packages accordingly to mitigate this risk.

A vulnerability identified as CVE-2025-47910 affects the Go programming language versions prior to 1.25.1. The flaw allows bypassing of security measures. A fix is available in version 1.25.1. The vulnerability is documented by the Bundesamt für Sicherheit in der Informationstechnik and affects Fedora distributions using the vulnerable Go versions.

Multiple vulnerabilities have been identified in Grafana, an open-source analytics and visualization software. These issues affect versions prior to 12.0.2+security-01 and the specific version 12.0.2+security-01. A fixed version 12.0.2+security-01 is available to address these vulnerabilities.

This entry refers to multiple vulnerabilities in the Linux kernel, which is the core component of the Linux operating system. No specific details about the vulnerabilities, affected versions, or impact are provided.

CVE-2025-3415 is a vulnerability in Grafana, an open-source analytics and visualization software, that allows information disclosure. No specific affected versions or detailed impact metrics are provided. There is no CVSS score or known exploits in the wild at this time.

A vulnerability in Grafana allows bypassing security measures. Grafana is an open-source analytics and visualization software. The issue affects versions prior to 10.4.19 and is fixed in version 10.4.19.