CVE-2025-59340

jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory.constructFromCanonical, it is possible to instruct the underlying ObjectMapper to deserialize attacker-controlled input into arbitrary classe...

@digitalocean/do-markdownit has Type Confusion vulnerability

Overview A type confusion issue exists in the @digitalocean/do-markdownit package. In the callout and fenceenvironment plugins, the allowedClasses and allowedEnvironments options are expected to be arrays of strings. If these options are provided as a single string, the code applies .includes...

GHSA-2H8J-8R9P-849F @digitalocean/do-markdownit has Type Confusion vulnerability

Overview A type confusion issue exists in the @digitalocean/do-markdownit package. In the callout and fenceenvironment plugins, the allowedClasses and allowedEnvironments options are expected to be arrays of strings. If these options are provided as a single string, the code applies .includes...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview @digitalocean/do-markdownit is a Markdown-It plugin for the DigitalOcean Community. Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' in the callout and fenceenvironment plugins when allowedClasses or allowedEnvironments is...

CVE-2025-59717

In the @digitalocean/do-markdownit package through 1.16.1 in npm, the callout and fenceenvironment plugins perform .includes substring matching if allowedClasses or allowedEnvironments is a string instead of an array...

CVE-2025-59717

The CVE concerns the @digitalocean/do-markdownit package (through v1.16.1). The callout and fence_environment plugins treat allowedClasses/allowedEnvironments as strings by using a substring check, instead of requiring an array. This leads to a type confusion-like behavior and potential bypass of...

CVE-2025-59717

In the @digitalocean/do-markdownit package through 1.16.1 in npm, the callout and fenceenvironment plugins perform .includes substring matching if allowedClasses or allowedEnvironments is a string instead of an array...

CVE-2025-59717

In the @digitalocean/do-markdownit package through 1.16.1 in npm, the callout and fenceenvironment plugins perform .includes substring matching if allowedClasses or allowedEnvironments is a string instead of an array...

CVE-2025-59717

In the @digitalocean/do-markdownit package through 1.16.1 in npm, the callout and fenceenvironment plugins perform .includes substring matching if allowedClasses or allowedEnvironments is a string instead of an array...

PT-2025-38507

Name of the Vulnerable Software and Affected Versions @digitalocean/do-markdownit versions through 1.16.1 Description The callout and fence environment plugins in the @digitalocean/do-markdownit package perform .includes substring matching if allowedClasses or allowedEnvironments is a string...

PT-2025-42246

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to index validation within configuration queues messaging in the i40e driver. Specifically, the issue occurs when iterating over vf-chidx in the...

CVE-2025-59340

jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory.constructFromCanonical, it is possible to instruct the underlying ObjectMapper to deserialize attacker-controlled input into arbitrary classe...

CVE-2025-59340 jinjava Sandbox Bypass via JavaType-Based Deserialization

jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory.constructFromCanonical, it is possible to instruct the underlying ObjectMapper to deserialize attacker-controlled input into arbitrary classe...

jinjava has Sandbox Bypass via JavaType-Based Deserialization

Summary jinjava’s current sandbox restrictions prevent direct access to dangerous methods such as getClass, and block instantiation of Class objects. However, these protections can be bypassed. By using mapper.getTypeFactory.constructFromCanonical, it is possible to instruct the underlying...

GHSA-M49C-G9WR-HV6V jinjava has Sandbox Bypass via JavaType-Based Deserialization

Summary jinjava’s current sandbox restrictions prevent direct access to dangerous methods such as getClass, and block instantiation of Class objects. However, these protections can be bypassed. By using mapper.getTypeFactory.constructFromCanonical, it is possible to instruct the underlying...

DEBIAN-CVE-2025-39810

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix memory corruption when FW resources change during ifdown bnxtsetdfltrings assumes that it is always called before any TC has been created. So it doesn't take bp-numtc into account and assumes that it is always 0 or 1...

UBUNTU-CVE-2025-39810

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix memory corruption when FW resources change during ifdown bnxtsetdfltrings assumes that it is always called before any TC has been created. So it doesn't take bp-numtc into account and assumes that it is always 0 or 1...

CVE-2025-39810

CVE-2025-39810 – bnxt_en memory corruption fix in the Linux kernel driver. The issue arises when FW resources change during interface down, where bnxt_set_dflt_rings() can size bp->tx_ring[] too small if bp->num_tc > 1, permitting memory corruption in bnxt_alloc_cp_rings(). The root caus...

CVE-2025-39810 bnxt_en: Fix memory corruption when FW resources change during ifdown

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix memory corruption when FW resources change during ifdown bnxtsetdfltrings assumes that it is always called before any TC has been created. So it doesn't take bp-numtc into account and assumes that it is always 0 or 1...

kernel: net/sched: ets: use old 'nbands' while purging unused classes

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: use old 'nbands' while purging unused classes Shuang reported schets test-case 1 crashing in etsclassqlennotify after recent changes from Lion 2. The problem is: in etsqdiscchange we purge unused DWRR queues; the...