CVE-2025-48473

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, when creating a conversation from a message in another conversation, there is no check to ensure that the user has the ability to view this message. Thus, the user can view arbitrary messages from other...

CVE-2025-48370

auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.70.0, the library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not require the user supplied values to be valid UUIDs. This could lead to a URL path traversal, resulting in the...

CVE-2025-48473 FreeScout Vulnerable to Insufficient Authorization

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, when creating a conversation from a message in another conversation, there is no check to ensure that the user has the ability to view this message. Thus, the user can view arbitrary messages from other...

CVE-2025-4598

creationtimestamp| type| source ---|---|--- 2025-05-29 15:19:54+00:00| seen| https://seclists.org/oss-sec/2025/q2/183 2025-05-29 17:47:17+00:00| seen| https://bsky.app/profile/buherator.bsky.social/post/3lqdblrdkqb2g 2025-05-29 17:57:31+00:00| seen|...

CVE-2024-22654

tcpreplay v4.4.4 was discovered to contain an infinite loop via the tcprewrite function at get.c...

CVE-2025-5320

creationtimestamp| type| source ---|---|--- 2025-05-29 15:13:58+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqcyzeeotyn2...

CVE-2025-33043

APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation locally. Successful exploitation of this vulnerability can potentially impact of integrity...

CVE-2025-37993

In the Linux kernel, the following vulnerability has been resolved: can: mcan: mcanclassallocatedev: initialize spin lock on device probe The spin lock txhandlingspinlock in struct mcanclassdev is not being initialized. This leads the following spinlock bad magic complaint from the kernel, eg. wh...

CVE-2025-37994

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix NULL pointer access This patch ensures that the UCSI driver waits for all pending tasks in the ucsidisplayportwork workqueue to finish executing before proceeding with the partner removal...

CVE-2025-37993

creationtimestamp| type| source ---|---|--- 2025-05-29 13:56:24+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqcuoocksnn2...

CVE-2025-37998

creationtimestamp| type| source ---|---|--- 2025-05-29 13:51:03+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqcufagmdgn2...

CVE-2025-37994

creationtimestamp| type| source ---|---|--- 2025-05-29 13:51:02+00:00| seen| https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3lqcuf73iwm22...

CVE-2025-37999

The CVE-2025-37999 issue affects the Linux kernel's EROFS fileio path. When bio_add_folio() fails, erofs_fileio_scan_folio() submits a new I/O request and retries with an empty bio, but erofs_onlinefolio_split() had already run, incrementing folio->private. The retry then calls erofs_onlinefol...

CVE-2025-37999 fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio()

In the Linux kernel, the following vulnerability has been resolved: fs/erofs/fileio: call erofsonlinefoliosplit after bioaddfolio If bioaddfolio fails because it is full, erofsfileioscanfolio needs to submit the I/O request via erofsfileiorqsubmit and allocate a new I/O request with an empty stru...

CVE-2025-37996 KVM: arm64: Fix uninitialized memcache pointer in user_mem_abort()

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix uninitialized memcache pointer in usermemabort Commit fce886a60207 "KVM: arm64: Plumb the pKVM MMU in KVM" made the initialization of the local memcache variable in usermemabort conditional, leaving a codepath whe...

CVE-2025-37995 module: ensure that kobject_put() is safe for module type kobjects

In the Linux kernel, the following vulnerability has been resolved: module: ensure that kobjectput is safe for module type kobjects In 'lookuporcreatemodulekobject', an internal kobject is created using 'modulektype'. So call to 'kobjectput' on error handling path causes an attempt to use an...

CVE-2025-48046

An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint...

CVE-2025-48045

An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials...

[SECURITY] [DLA 4189-1] webpy security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4189-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk May 29, 2025 https://wiki.debian.org/LTS -...

CVE-2025-48388

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, the application performs insufficient validation of user-supplied data, which is used as arguments to string formatting functions. As a result, an attacker can pass a string containing special symbols \r, \n,...