CLSA-2025-1758892548 glibc: Fix of CVE-2025-4802

CVE-2025-4802: prevent untrusted LDLIBRARYPATH from loading dynamically shared libraries in statically compiled binaries that call dlopen...

USN-7775-2 linux-azure vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - PowerPC architecture; - x86 architecture; - ACPI drivers; - Serial ATA and Parallel ATA...

CVE-2025-10965

A security vulnerability has been detected in LazyAGI LazyLLM up to 0.6.1. Affected by this issue is the function lazyllmcall of the file lazyllm/components/deploy/relay/server.py. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed...

CVE-2025-59534

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures SDLS-EP to secure communications between a spacecraft running the core Flight System cFS and a ground station. Prior to version 1.4.2, there is a command Injection vulnerability in...

kernel: vsock: Fix transport_* TOCTOU

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix transport TOCTOU Transport assignment may race with module unload. Protect newtransport from becoming a stale pointer. This also takes care of an insecure call in vsockuselocaltransport; add a lockdep assert. BUG: unab...

PT-2025-39448

Name of the Vulnerable Software and Affected Versions LazyAGI LazyLLM versions prior to 0.6.2 Description A security issue has been identified in LazyAGI LazyLLM. This concerns the deserialization of data within the lazyllm call function located in the lazyllm/components/deploy/relay/server.py...

Linux Distros Unpatched Vulnerability : CVE-2023-53423

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: objtool: Fix memory leak in createstaticcallsections strdup allocates memory for keyname. We...

CVE-2025-27034 Improper Validation of Array Index in Multi-Mode Call Processor

Memory corruption while selecting the PLMN from SOR failed list...

CVE-2025-9487

The Admin and Site Enhancements ASE WordPress plugin before 7.9.8 does not sanitise SVG files when uploaded via xmlrpc.php when such uploads are enabled, which could allow users to upload a malicious SVG containing XSS payloads...

ocfs2: fix recursive semaphore deadlock in fiemap call

...

CVE-2025-59534

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures SDLS-EP to secure communications between a spacecraft running the core Flight System cFS and a ground station. Prior to version 1.4.2, there is a command Injection vulnerability in...

CVE-2025-59534

CryptoLib (NASA’s library using CCSDS SDLS-EP) contains a command-injection vulnerability in initialize_kerberos_keytab_file_login() present in versions prior to 1.4.2. The flaw arises from unsanitized, user-controlled input directly interpolated into a shell command and executed via system(), en...

CVE-2025-39885

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive semaphore deadlock in fiemap call syzbot detected a OCFS2 hang due to a recursive semaphore on a FSIOCFIEMAP of the extent list on a specially crafted mmap file. contextswitch kernel/sched/core.c:5357 inline...

CVE-2025-39885

CVE-2025-39885 affects the OCFS2 filesystem in Linux kernels. The vulnerability stems from a recursive semaphore deadlock during fiemap processing of a specially crafted mmap’ed file: ocfs2_fiemap() takes a read lock on ip_alloc_sem, then fiemap_fill_next_extent() accesses the extent list while a...

CVE-2025-39885

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive semaphore deadlock in fiemap call syzbot detected a OCFS2 hang due to a recursive semaphore on a FSIOCFIEMAP of the extent list on a specially crafted mmap file. contextswitch kernel/sched/core.c:5357 inline...

CryptoLib operating system command injection vulnerability

CryptoLib is a NASA open source application. It is used to provide a software-only solution using the CCSDS space data link security protocol. An operating system command injection vulnerability exists in CryptoLib versions prior to 1.4.2, which stems from the initializekerberoskeytabfilelogin...

PT-2025-39207

Name of the Vulnerable Software and Affected Versions CryptoLib versions prior to 1.4.2 Description CryptoLib is a software solution utilizing the CCSDS Space Data Link Security Protocol - Extended Procedures SDLS-EP for secure communications between spacecraft and ground stations. A command...

kernel: vsock: Fix transport_* TOCTOU

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix transport TOCTOU Transport assignment may race with module unload. Protect newtransport from becoming a stale pointer. This also takes care of an insecure call in vsockuselocaltransport; add a lockdep assert. BUG: unab...

CVE-2025-9487 Admin and Site Enhancements < 7.9.8 - Authenticated Stored XSS via SVG

The Admin and Site Enhancements ASE WordPress plugin before 7.9.8 does not sanitise SVG files when uploaded via xmlrpc.php when such uploads are enabled, which could allow users to upload a malicious SVG containing XSS payloads...

PT-2025-38690

Name of the Vulnerable Software and Affected Versions Admin and Site Enhancements ASE WordPress plugin versions prior to 7.9.8 Description The software does not properly sanitize SVG files when uploaded through the xmlrpc.php file, if SVG uploads are enabled. This could allow an attacker to uploa...