karchive:ktar_xz_fuzzer: Use-of-uninitialized-value in lzma_index_hash_decode

Detailed Report: https://oss-fuzz.com/testcase?key=4813479728185344 Project: karchive Fuzzing Engine: libFuzzer Fuzz Target: ktarxzfuzzer Job Type: libfuzzermsankarchive Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: lzmaindexhashdecode streamdecode autodeco...

kimageformats:kimgio_psd_fuzzer: Use-of-uninitialized-value in PSDHandler::read

Project: git://anongit.kde.org/kimageformats Detailed Report: https://oss-fuzz.com/testcase?key=4738025742729216 Project: kimageformats Fuzzing Engine: libFuzzer Fuzz Target: kimgiopsdfuzzer Job Type: libfuzzermsankimageformats Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

CVE-2024-44664

PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the name, summary, review, quality, price, and value parameters in product-details.php...

PHPGurukul Online Shopping Portal has a security vulnerability

Online Shopping Portal is an online store system. Online Shopping Portal suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements for the name, summary, review, quality, price, and value parameters in product-details.php. An attacker c...

karchive:k7z_fuzzer: Use-of-uninitialized-value in crc32_z

Project: git://anongit.kde.org/karchive Detailed Report: https://oss-fuzz.com/testcase?key=5913949670539264 Project: karchive Fuzzing Engine: libFuzzer Fuzz Target: k7zfuzzer Job Type: libfuzzermsankarchive Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: crc3...

kimageformats:kimgio_xcf_fuzzer: Use-of-uninitialized-value in QImage::pixel

Project: git://anongit.kde.org/kimageformats Detailed Report: https://oss-fuzz.com/testcase?key=5281479564525568 Project: kimageformats Fuzzing Engine: libFuzzer Fuzz Target: kimgioxcffuzzer Job Type: libfuzzermsankimageformats Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

karchive:kzip_fuzzer: Use-of-uninitialized-value in inflate

Project: git://anongit.kde.org/karchive Detailed Report: https://oss-fuzz.com/testcase?key=4860655984508928 Project: karchive Fuzzing Engine: libFuzzer Fuzz Target: kzipfuzzer Job Type: libfuzzermsankarchive Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

karchive:ktar_lz_fuzzer: Use-of-uninitialized-value in KTar::KTarPrivate::readRawHeader

Detailed Report: https://oss-fuzz.com/testcase?key=5368230320603136 Project: karchive Fuzzing Engine: libFuzzer Fuzz Target: ktarlzfuzzer Job Type: libfuzzermsankarchive Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: KTar::KTarPrivate::readRawHeader...

bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO

...

net: mctp: Don't access ifa_index when missing

...

Whose Narrative Is It Anyway? A KV Cache Manipulation Attack

The Key ValueKV cache is an important component for efficient inference in autoregressive Large Language Models LLMs, but its role as a representation of the model's internal state makes it a potential target for integrity attacks. This paper introduces "History Swapping," a novel block-level...

Iranian Hackers Launch 'SpearSpecter' Spy Operation on Defense & Government Targets

The Iranian state-sponsored threat actor known as APT42 has been observed targeting individuals and organizations that are of interest to the Islamic Revolutionary Guard Corps IRGC as part of a new espionage-focused campaign. The activity, detected in early September 2025 and assessed to be...

OESA-2025-2684 python-ldap security update

python-ldap: python-ldap provides an object-oriented API to access LDAP directory servers from Python programs. Mainly it wraps the OpenLDAP 2.x libs for that purpose. Additionally the package contains modules for other LDAP-related stuff e.g. processing LDIF, LDAPURLs, LDAPv3 schema, LDAPv3...

SUSE CVE-2025-40154

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcrrt5640: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcrrt5640 driver only shows an error message but leaves as is. This may lead to unepxected results like OOB...

CVE-2025-4616: Improper Validation of Integrity Check Value

An insufficient validation of an untrusted input vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to revert the browser’s security controls...

ffmpeg:ffmpeg_AV_CODEC_ID_FFV1_fuzzer: Use-of-uninitialized-value in encode_slice

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=6370167888347136 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDFFV1fuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type:...

CVE-2025-40154

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcrrt5640: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcrrt5640 driver only shows an error message but leaves as is. This may lead to unepxected results like OOB...

Linux Distros Unpatched Vulnerability : CVE-2025-40117

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: misc: pciendpointtest: Fix array underflow in pciendpointtestioctl Commit eefb83790a0d misc:...

CVE-2025-40187 net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()

In the Linux kernel, the following vulnerability has been resolved: net/sctp: fix a null dereference in sctpdisposition sctpsfdo51Dce If newasoc-peer.adaptationind=0 and sctpulpeventmakeauthkey=0 and sctpulpeventmakeauthkey returns 0, then the variable aiev remains zero and the zero will be...

CVE-2025-64186

Evervault is a payment security solution. A vulnerability was identified in the evervault-go SDK’s attestation verification logic in versions of evervault-go prior to 1.3.2 that may allow incomplete documents to pass validation. This may cause the client to trust an enclave operator that does not...