PT-2025-46552

Name of the Vulnerable Software and Affected Versions Academy Software Foundation OpenEXR affected versions not specified Description A flaw exists in the parsing of EXR files due to insufficient validation of user-supplied data length before copying it to a heap-based buffer. This can allow a...

BIT-MLFLOW-2025-11201 MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability

MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The specific flaw...

[SECURITY] Fedora 42 Update: qt5-qtserialbus-5.15.18-1.fc42

Qt Serial Bus API provides classes and functions to access the various industrial serial buses and protocols, such as CAN, ModBus, and others...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989345)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989345 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep The ilitek-ili9881c...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988989)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988989 advisory. In the Linux kernel, the following vulnerability has been resolved: can: isotp: sanitize CAN ID checks in isotpbind Syzbot created an environment that lead to a stat...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990379)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990379 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: vhci-hcd: Do not drop references before new references are gained At a few places the driver...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989547)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989547 advisory. In the Linux kernel, the following vulnerability has been resolved: can: mcbausb: fix memory leak in mcbausb Syzbot reported memory leak in SocketCAN driver for...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989454)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989454 advisory. In the Linux kernel, the following vulnerability has been resolved: can: afcan: fix NULL pointer dereference in canrcvfilter Analogue to commit 8aa59e355949 can:...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988958)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988958 advisory. In the Linux kernel, the following vulnerability has been resolved: can: mcan: mcantxhandler: fix use after free of skb canputechoskb will clone skb then free the sk...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989952)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989952 advisory. In the Linux kernel, the following vulnerability has been resolved: can: dev: canrestart: fix use after free bug After calling netifrxniskb, dereferencing skb is...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-988813)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988813 advisory. In the Linux kernel, the following vulnerability has been resolved: can: afcan: fix NULL pointer dereference in canrxregister It causes NULL pointer dereference when...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989626)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989626 advisory. In the Linux kernel, the following vulnerability has been resolved: net: afcan: do not leave a dangling sk pointer in cancreate On error cancreate frees the allocate...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990373)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990373 advisory. In the Linux kernel, the following vulnerability has been resolved: net: afcan: do not leave a dangling sk pointer in cancreate On error cancreate frees the allocate...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989174)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989174 advisory. In the Linux kernel, the following vulnerability has been resolved: can: dev: cangetechoskb: prevent call to kfreeskb in hard IRQ context If a driver calls...

SUSE CVE-2025-40107

In the Linux kernel, the following vulnerability has been resolved: can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled This issue is similar to the vulnerability in the mcp251x driver, which was fixed in commit 03c427147b2d "can: mcp251x: fix resume fr...

CVE-2025-40107

In the Linux kernel, the following vulnerability has been resolved: can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled This issue is similar to the vulnerability in the mcp251x driver, which was fixed in commit 03c427147b2d "can: mcp251x: fix resume fr...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Can: kvaserpciefd: refined error-prone handling of echoskbmax echoskbmax should define the supported upper limit for echoskb, which is allocated within the private space of the netdevice. The corresponding size value provided ...

China-Linked Hackers Exploit Windows Shortcut Flaw to Target European Diplomats

A China-affiliated threat actor known as UNC6384 has been linked to a fresh set of attacks exploiting an unpatched Windows shortcut vulnerability to target European diplomatic and government entities between September and October 2025. The activity targeted diplomatic organizations in Hungary,...

MLflow Weak Password Requirements Authentication Bypass Vulnerability

MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords...

CVE-2025-11201

MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The specific flaw...