PSIRT bulletins, normalized

VU#763488: Memory corruption vulnerabilities in PHP

VU#645818: Xerj Console API Authentication Bypass Leads to Unauthorized Credential Minting

VU#410595: Google BoringSSL Name Constraints Bypass in SAN Validation Logic

VU#948176: Multiple TLS Libraries can Bypass Delegation Enforcement

VU#166125: Bisheng has authentication bypass vulnerabilities

VU#456950: Komodo Periphery Agent Contains an OS Command Injection Vulnerability

VU#382143: Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration

VU#573195: Go, OpenSSL, Apple, LibreSSL, pyca, wolfSSL Name-Constraint Inconsistency in RFC 5280 Implementation

VU#157374: XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE

VU#162329: Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1

VU#553437: InsydeH2O IHISI SMM is vulnerable to unsafe memory write operations

VU#762428: Authlib library contains a signature‑verification bypass vulnerability

VU#699627: Readwise Reader for Android, version 8.7.2, contains multiple XSS vulnerabilities

VU#234131: ViewSonic vCast media streaming service allows unauthenticated screen exfiltration and device compromise

VU#676317: Norwegian Cruise Line door access controller contains an improper authentication vulnerability

VU#273940: Enterprise Access Management EAM does not rotate RSA keys

VU#754548: Cinnamon's Kotaemon contains improper authorization checks in Kotaemon multi‑user chat handlers

VU#738147: Vendor-signed UEFI Shell applications allow Secure Boot bypass

VU#280377: Dokploy is vulnerable to OS command injection

VU#369093: MLflow dspy and statsmodels flavors bypass pickle deserialization control

VU#457458: Vendor-signed UEFI applications found vulnerable to Secure Boot bypass

VU#380058: SignalRGB kernel driver contains improper access control and IOCTL vulnerabilities

VU#862559: crypton-x509-validation Haskell libraries do not enforce X.509 NameConstraints

VU#616257: Microsoft-signed UEFI shim bootloaders vulnerable to Secure Boot bypass

VU#595768: Securly Chrome Extension contains multiple weak encryption and access control vulnerabilities

VU#615987: Missing IPsec Integrity Protection for IMS SIP Signaling in Verizon VoLTE Deployments

VU#265691: Appsmiths SQL Query autocomplete renderer contains a cross site scripting vulnerability

VU#873170: Collibra Agent contains improper authentication and path traversal vulnerabilities

VU#158530: PCTCore64.sys Windows kernel driver contains missing access control vulnerability

VU#780781: Casdoor contains multiple authentication bypass and access management vulnerabilities

VU#980487: Local privilege escalation in Linux Kernel (Dirty Frag)

VU#777338: SGLang contains two remote code execution and one path traversal vulnerability

VU#471747: dnsmasq contains several vulnerabilities, including attacker DNS redirect, privilege escalation, and heap manipulation

VU#937808: Casdoor contains Arbitrary File Write vulnerability

VU#260001: Linux kernel contains local privilege escalation vulnerability (Copy Fail)

VU#748485: Unauthenticated configuration modification vulnerability in Central Office Services - Content Hosting Component

VU#518910: Ollama GGUF Quantization Remote Memory Leak

VU#890999: Radware Alteon has a reflected XSS vulnerability that can execute JavaScript in the host browser

VU#414811: Terrarium contains a vulnerability that allows arbitrary code execution