CVE-2025-52922

Innoshop through 0.4.1 allows directory traversal via FileManager API endpoints. An authenticated attacker with access to the admin panel could abuse this to: 1 fully map the filesystem structure via the /api/filemanager/files?basefolder= endpoint, 2 create arbitrary directories on the server via...

Linux kernel Function Use-After-Free

The vulnerability of the userfencecreate function in the drivers/gpu/drm/xe/xesync.c kernel module of the Linux operating system is related to writing beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibilit...

Linux net/smc/af_smc Heap Buffer Overflow DoS

The vulnerability of the smccreate function in the net/smc/afsmc.c module of the Linux operating system is related to the reutilization of previously released memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

Linux RPC Protocol Heap Buffer Overflow DoS

The vulnerability of the svccreatesocket function in the net/sunrpc/svcsock.c module of the Linux operating system’s RPC implementation is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux nfs3_proc_create Buffer Overflow

The vulnerability of the nfs3proccreate function in the fs/nfs/nfs3proc.c module of the Linux file system support module is related to improper memory release before deleting the last reference memory leak. Exploiting this vulnerability could allow an attacker to compromise the confidentiality an...

CVE-2025-6282

The CVE-2025-6282 issue affects xlang-ai OpenAgents, specifically the create_upload_file function in backend/api/file.py, where a path traversal vulnerability is introduced. Multiple connected sources confirm the vulnerability is critical and that the exploit has been disclosed publicly, with Ope...

SUSE CVE-2022-50071

In the Linux kernel, the following vulnerability has been resolved: mptcp: move subflow cleanup in mptcpdestroycommon If the mptcp socket creation fails due to a CGROUPINETSOCKCREATE eBPF program, the MPTCP protocol ends-up leaking all the subflows: the related cleanup happens in mptcpdestroysock...

Linux kernel can_create() Heap Buffer Overflow

The vulnerability of the cancreate function in the net/can/afcan.c module of the Linux kernel is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

DEBIAN-CVE-2022-50127

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix error unwind in rxecreateqp In the function rxecreateqp, rxeqpfrominit is called to initialize qp, internally things like the spin locks are not setup until rxeqpinitreq. If an error occures before this point then t...

AZL-70352 CVE-2022-50071 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: mptcp: move subflow cleanup in mptcpdestroycommon If the mptcp socket creation fails due to a CGROUPINETSOCKCREATE eBPF program, the MPTCP protocol ends-up leaking all the subflows: the related cleanup happens in mptcpdestroysock...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from rxecreateqp not handling queue pair cleanup correctly, which could lead to null pointer dereferencing...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from rxecreateqp not properly initializing a spinlock, which could lead to a null pointer dereference...

Directory Traversal

Overview python-a2a is an A comprehensive Python library for Google's Agent-to-Agent A2A protocol Affected versions of this package are vulnerable to Directory Traversal via the createworkflow function in the api.py file. An attacker can access or modify files outside the intended directory by...

PYSEC-2025-64

A vulnerability classified as critical has been found in themanojdesai python-a2a up to 0.5.5. Affected is the function createworkflow of the file pythona2a/agentflow/server/api.py. The manipulation leads to path traversal. Upgrading to version 0.5.6 is able to address this issue. It is recommend...

Python A2A path traversal vulnerability

Python A2A is a functional Python library by the individual developer Manoj Desai for implementing Google's A2A protocol. A security vulnerability exists in Python A2A version 0.5.5 and earlier, which stems from a path traversal issue in the function createworkflow in the file...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: “spufs”: fixed a leak in spufscreatecontext. The fix for the leak was implemented back in 2008; however, it overlooked one case—if we try to set affinity, and spufsmkdir fails, we need to remove the reference to the neighbor obje...

AZL-78978 CVE-2025-0913 affecting package golang 1.26.7-1

os.OpenFilepath, os.OCREATE|OEXCL behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with OCREATE and OEXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would...

UBUNTU-CVE-2025-0913

os.OpenFilepath, os.OCREATE|OEXCL behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with OCREATE and OEXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would...

CVE-2025-0913 Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall

os.OpenFilepath, os.OCREATE|OEXCL behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with OCREATE and OEXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would...

Symlink Attack

Overview std/os is a Go standard library package std/os Affected versions of this package are vulnerable to Symlink Attack. Go Vulnerability Report:os.OpenFilepath, os.OCREATE|OEXCL behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems,...