CVE-2025-38065 orangefs: Do not truncate file size

In the Linux kernel, the following vulnerability has been resolved: orangefs: Do not truncate file size 'len' is used to store the result of isizeread, so making 'len' a sizet results in truncation to 4GiB on 32-bit systems...

CVE-2025-38058

CVE-2025-38058 affects the Linux kernel: the function __legitimize_mnt() in fs/namespace.c mis-handled synchronization around MNT_SYNC_UMOUNT, risking an incorrect mnt_count handling and a dropped reference to the caller after umount(2) checks but before MNT_SYNC_UMOUNT is set. The issue is resol...

CVE-2025-38039 net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid WARNON when configuring MQPRIO with HTB offload enabled When attempting to enable MQPRIO while HTB offload is already configured, the driver currently returns -EINVAL and triggers a WARNON, leading to an...

CVE-2025-38038 cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost

In the Linux kernel, the following vulnerability has been resolved: cpufreq: amd-pstate: Remove unnecessary driverlock in setboost setboost is a per-policy function call, hence a driver wide lock is unnecessary. Also this mutexacquire can collide with the mutexacquire from the mode-switch path in...

CVE-2025-6019

A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the "allowactive" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allowactive" user on a syst...

CVE-2025-6099

A vulnerability was found in szluyu99 gin-vue-blog up to 61dd11ccd296e8642a318ada3ef7b3f7776d2410. It has been declared as critical. This vulnerability affects unknown code of the file gin-blog-server/internal/manager.go of the component PATCH Request Handler. The manipulation leads to improper...

CVE-2025-44952

Open5GS PFCP substrate vulnerability CVE-2025-44952: A missing length check in ogs_pfcp_subnet_add within the PFCP library (used by Open5GS SMF/UPF) allows a local attacker to trigger a buffer overflow by supplying a session.dnn value longer than 101 characters. Affected: Open5GS versions 2.7.2 a...

CVE-2025-49487

Trend Micro Worry-Free Business Security Services (WFBSS) SaaS client is vulnerable to an uncontrolled search path/element that could allow an attacker with physical access to execute arbitrary code (in ZDI, as SYSTEM). The on-premise WFBSS is not affected. Root cause is tied to loading an OpenSS...

CVE-2025-34509

Sitecore XM/XP affected: Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE; root cause is a hardcoded user account that allows unauthenticated, remote access to the ad...

CVE-2025-49863

creationtimestamp| type| source ---|---|--- 2025-06-17 18:08:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrt3ngymvn2r 2025-06-18 17:39:01+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18797...

CVE-2025-49253

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in thembay Lasa lasa allows PHP Local File Inclusion.This issue affects Lasa: from n/a through = 1.1...

CVE-2025-4404

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the krbCanonicalName for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a...

CVE-2025-49842 conda-forge-webservices Privilege Escalation Risk via Default Docker Root User

conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. Prior to version 2025.3.24, the condaforgewebservice Docker container executes commands without specifying a user. By default, Docker containers run as the root user, which increases the risk of privile...

CVE-2025-5310

creationtimestamp| type| source ---|---|--- 2025-06-17 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-168-05 2025-06-17 20:03:09+00:00| seen| https://bsky.app/profile/pigondrugs.bsky.social/post/3lrtc272xow2q 2025-06-18 07:52:46+00:00| seen|...

CVE-2025-6141

A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocesstermcap of the file tinfo/parseentry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to...

CVE-2025-27587

OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVPDigestSign API, and then using the private key to extract the K value nonce from the signatures. Next, based on the bit size of t...

CVE-2025-6139 TOTOLINK T10 shadow.sample hard-coded password

A vulnerability, which was classified as problematic, has been found in TOTOLINK T10 4.1.8cu.5207. Affected by this issue is some unknown functionality of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. The attack can only be initiated within the local network...

CVE-2025-32799

CVE-2025-32799 affects conda-build prior to 25.4.0, where tar entry path sanitization allows path traversal (Tarslip) in created/extracted archives. Attacks could overwrite files outside the extraction directory, potentially leading to privilege escalation or code execution. A fix is available in...

CVE-2025-6179

creationtimestamp| type| source ---|---|--- 2025-06-16 17:26:39+00:00| seen| https://bsky.app/profile/potato.software/post/3lrqitgt44s2p 2025-06-16 17:38:01+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18486 2025-06-16 19:30:29+00:00| seen|...

CVE-2025-49125

creationtimestamp| type| source ---|---|--- 2025-06-16 14:38:05+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18453 2025-06-16 15:02:05+00:00| seen| https://infosec.exchange/users/vuldb/statuses/114693644318306796 2025-06-16 15:19:46+00:00| seen| https://seclists.org/oss-sec/2025/q2/253...