Medium: pcs

Issue Overview: Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host XFH header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrar...

Important: amazon-cloudwatch-agent

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...

Medium: edk2

Issue Overview: EDK2 contains a vulnerability in the HashPeImageByType. A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. CVE-2024-38797...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifsdumpfullkey CVE-2024-35866 In the Linux kernel, the following vulnerability has been resolved: cifs: Fix integer overflow while processing closetimeo mount option CVE-2025-219...

Amazon Linux 2023 : nvidia-open (ALAS2023NVIDIA-2025-061)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023NVIDIA-2025-061 advisory. NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an unprivileged attacker to escalate permissions. A successful exploit of this vulnerability might lead to code...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2025-071)

The version of kernel installed on the remote host is prior to 5.15.180-123.192. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.15-2025-071 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: do not clean up repair bio if submit...

Amazon Linux AMI : kernel (ALAS-2025-1977)

The version of kernel installed on the remote host is prior to 4.14.355-196.643. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2025-1977 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: do not clean up repair bio if submit fai...

Amazon Linux 2023 : elfutils, elfutils-default-yama-scope, elfutils-devel (ALAS2023-2025-969)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-969 advisory. A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function libdwthreadtail in the library libdwalloc.c of the component eu-readelf...

Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2025-966)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-966 advisory. An issue in sqlite v.3.49.0 allows an attacker to cause a denial of service via the SQLITEDBCONFIGLOOKASIDE component CVE-2025-29088 Integer Overflow vulnerability in SQLite SQLite3 v.3.50.0...

Amazon Linux 2023 : libnvidia-nscq (ALAS2023NVIDIA-2025-067)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023NVIDIA-2025-067 advisory. NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an unprivileged attacker to escalate permissions. A successful exploit of this vulnerability might lead to code...

Amazon Linux 2023 : lemon, sqlite, sqlite-analyzer (ALAS2023-2025-971)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-971 advisory. SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such ...

Amazon Linux 2 : jetty (ALAS-2025-2855)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2855 advisory. For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2025-099)

The version of kernel installed on the remote host is prior to 5.4.156-83.273. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2025-099 advisory. A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users d...

Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2025-968)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-968 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which...

Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2025-964)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-964 advisory. Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a...

Important: kmod-nvidia-latest-dkms

Issue Overview: NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an unprivileged attacker to escalate permissions. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data...

Important: sqlite

Issue Overview: SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE. CVE-2022-46908 Affected Packages: sqlite Issue Correction: Run dn...

Medium: nodejs22

Issue Overview: An issue in sqlite v.3.49.0 allows an attacker to cause a denial of service via the SQLITEDBCONFIGLOOKASIDE component CVE-2025-29088 Affected Packages: nodejs22 Issue Correction: Run dnf update nodejs22 --releasever 2023.7.20250512 to update your system. New Packages: aarch64: ...

Low: jetty

Issue Overview: For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a...

Important: tomcat

Issue Overview: Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException...