CVE-2025-69262 pnpm vulnerable to Command Injection via environment variable substitution

pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables during pnpm operations could achieve Remote Cod...

CVE-2025-34171 CasaOS <= 0.4.15 Unauthenticated File and Debug Data Exposure

CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and system debug information. The /v1/users/image endpoint can be abused with a user-controlled path parameter to access files under...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992896)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992896 advisory. In the Linux kernel, the following vulnerability has been resolved: fbdev: fbpm2fb: Avoid potential divide by zero error In dofbioctl of fbmem.c, if cmd is...

CVE-2025-50343

An issue was discovered in matio 1.5.28. A heap-based memory corruption can occur in MatVarCreateStruct when the nfields value does not match the actual number of strings in the fields array. This leads to out-of-bounds reads and invalid memory frees during cleanup, potentially causing a...

Unity Linux 20.1050e Security Update: kernel (UTSA-2025-991174)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991174 advisory. In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential double free in createvarref In createvarref, initvarref is called to...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal in the untar process. An attacker can execute arbitrary code with elevated privileges by crafting a malicious archive containing symbolic links that overwrite critical files such as /var/run/argo/argoexec, which...

OESA-2025-2753 containerd security update

containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

TencentOS Server 3: insights-client (TSSA-2023:0266)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0266 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

CVE-2024-25621

containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths /var/lib/containerd,...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990406)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990406 advisory. In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential double free in createvarref In createvarref, initvarref is called to...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990623)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990623 advisory. In the Linux kernel, the following vulnerability has been resolved: fbdev: savage: Handle err return when savagefbcheckvar failed The commit 04e5eac8f3abfbdev: savag...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990500)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990500 advisory. In the Linux kernel, the following vulnerability has been resolved: net/iucv: Avoid explicit cpumask var allocation on stack For CONFIGCPUMASKOFFSTACK=y kernel,...

Security update for aws-efs-utils

This update for aws-efs-utils fixes the following issues: Update to version 2.3.3 bsc1240044. Security issues fixed: CVE-2025-55159: slab: incorrect bounds check in getdisjointmut function can lead to potential crash due to out-of-bounds access bsc1248055. CVE-2020-35881: traitobject: log4rs:...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990331)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990331 advisory. In the Linux kernel, the following vulnerability has been resolved: net/iucv: Avoid explicit cpumask var allocation on stack For CONFIGCPUMASKOFFSTACK=y kernel,...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989893)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989893 advisory. In the Linux kernel, the following vulnerability has been resolved: net/iucv: Avoid explicit cpumask var allocation on stack For CONFIGCPUMASKOFFSTACK=y kernel,...

Unity Linux 20.1050e Security Update: kernel (UTSA-2025-990009)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990009 advisory. In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Fix memory leak problem This reverts commit...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989251)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989251 advisory. In the Linux kernel, the following vulnerability has been resolved: tty: Fix out-of-bound vmalloc access in imageblit This issue happens when a userspace program doe...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: fbdev: The issue was fixed by correcting fbsetvar to prevent a null-ptr dereference in fbvideomodetovar. If fbaddvideomode in fbsetvar fails to allocate memory for fbvideomode, it may lead to a null-ptr dereference in...

CVE-2022-50553

In the Linux kernel, the following vulnerability has been resolved: tracing/hist: Fix out-of-bound write on 'actiondata.varrefidx' When generate a synthetic event with many params and then create a trace action for it 1, kernel panic happened 2. It is because that in traceactioncreate...

CVE-2022-50553 tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx'

In the Linux kernel, the following vulnerability has been resolved: tracing/hist: Fix out-of-bound write on 'actiondata.varrefidx' When generate a synthetic event with many params and then create a trace action for it 1, kernel panic happened 2. It is because that in traceactioncreate...