DEBIAN-CVE-2025-22035

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in printgraphfunctionflags during tracer switching Kairui reported a UAF issue in printgraphfunctionflags during ftrace stress testing 1. This issue can be reproduced if puting a 'mdelay10' after...

UBUNTU-CVE-2025-22035

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in printgraphfunctionflags during tracer switching Kairui reported a UAF issue in printgraphfunctionflags during ftrace stress testing 1. This issue can be reproduced if puting a 'mdelay10' after...

CVE-2025-22035 tracing: Fix use-after-free in print_graph_function_flags during tracer switching

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in printgraphfunctionflags during tracer switching Kairui reported a UAF issue in printgraphfunctionflags during ftrace stress testing 1. This issue can be reproduced if puting a 'mdelay10' after...

CVE-2025-22035

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in printgraphfunctionflags during tracer switching Kairui reported a UAF issue in printgraphfunctionflags during ftrace stress testing 1. This issue can be reproduced if puting a 'mdelay10' after...

Clustering and Analysis of User Behaviour in Blockchain: a Case Study of Planet IX

Decentralised applications dApps that run on public blockchains have the benefit of trustworthiness and transparency as every activity that happens on the blockchain can be publicly traced through the transaction data. However, this introduces a potential privacy problem as this data can be track...

PT-2025-16279 · Autogpt · Autogpt

Name of the Vulnerable Software and Affected Versions: AutoGPT versions prior to 0.6.1 Description: The AutoGPT Platform's WebSocket API transmitted node execution updates to subscribers based on the graph id+graph version. However, there was no check prohibiting users from subscribing with anoth...

CVE-2025-32032

The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerability in Apollo Router allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan,...

CVE-2025-31496 apollo-compiler Named Fragment Processing Vulnerability

apollo-compiler is a query-based compiler for the GraphQL query language. Prior to 1.27.0, a vulnerability in Apollo Compiler allowed queries with deeply nested and reused named fragments to be prohibitively expensive to validate. Named fragments were being processed once per fragment spread in...

GraphQL grant on a property might be cached with different objects

Original message: I found an issue with security grants on on properties in the GraphQL ItemNormalizer: If you use something like ApiPropertysecurity: 'isgranted"PROPERTYREAD", object, property' on a member of an entity, the grant gets cached and is only evaluated once, even if the object in...

GraphQL query operations security can be bypassed

Summary Using the Relay special node type you can bypass the configured security on an operation. Details Here is an example of how to apply security configurations for the GraphQL operations: php ApiResource security: "isgranted'ROLEUSER'", operations: / ... / , graphQlOperations: new...

PT-2025-22201

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue arises when the kernel contains a large number of functions that can be traced. The loop in ftrace graph set hash may take a significant amount of time to execute, potentially...

AWS VDP: Non-Production API Endpoints for the Neptune Graph Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration

The non-production API endpoints for the Neptune Graph Service were found to fail logging to CloudTrail, resulting in silent permission enumeration. Specifically, seven non-production endpoints were identified that could be used with standard IAM credentials without generating CloudTrail logs. Th...

Malicious code in @sas-dvr/nova-graph (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2ee49dd296a0db13b0118e5424d00aac99ea70cc3664bba504af096916e31998 The OpenSSF Package Analysis project identified '@sas-dvr/nova-graph' @ 132.0.0 npm as malicious. It is considered malicious because: - The...

SUSE CVE-2022-49752

In the Linux kernel, the following vulnerability has been resolved: device property: fix of node refcount leak in fwnodegraphgetnextendpoint The 'parent' returned by fwnodegraphgetportparent with refcount incremented when 'prev' is not NULL, it needs be put when finish using it. Because the paren...

DEBIAN-CVE-2022-49752

In the Linux kernel, the following vulnerability has been resolved: device property: fix of node refcount leak in fwnodegraphgetnextendpoint The 'parent' returned by fwnodegraphgetportparent with refcount incremented when 'prev' is not NULL, it needs be put when finish using it. Because the paren...

UBUNTU-CVE-2022-49752

In the Linux kernel, the following vulnerability has been resolved: device property: fix of node refcount leak in fwnodegraphgetnextendpoint The 'parent' returned by fwnodegraphgetportparent with refcount incremented when 'prev' is not NULL, it needs be put when finish using it. Because the paren...

CVE-2022-49752 device property: fix of node refcount leak in fwnode_graph_get_next_endpoint()

In the Linux kernel, the following vulnerability has been resolved: device property: fix of node refcount leak in fwnodegraphgetnextendpoint The 'parent' returned by fwnodegraphgetportparent with refcount incremented when 'prev' is not NULL, it needs be put when finish using it. Because the paren...

CVE-2025-27793

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 5.32.0, corresponding to vega-functions prior to version 5.17.0, users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code...

PT-2025-13194

Name of the Vulnerable Software and Affected Versions Vega versions prior to 5.32.0 vega-functions versions prior to 5.17.0 Description The issue allows users running Vega/Vega-lite JSON definitions to run unexpected JavaScript code when drawing graphs, unless the library was used with the...

PT-2025-13294 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A node refcount leak issue has been identified in the function fwnode graph get next endpoint. This occurs because the parent returned by fwnode graph get port parent has its refcount...