Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2023-52927: netfilter: allow exp not to be removed in nfctfindexpectation bsc1239644. CVE-2024-26708: mptcp: fix inconsistent state on fastopen race...

SUSE-SU-2025:20260-1 Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2023-52927: netfilter: allow exp not to be removed in nfctfindexpectation bsc1239644. - CVE-2024-26708: mptcp: fix inconsistent state on fastopen...

WordPress Drag and Drop Multiple File Upload for WooCommerce plugin <= 1.1.4 - Unauthenticated Arbitrary File Move vulnerability

Unauthenticated Arbitrary File Move vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Drag and Drop Multiple File Upload for WooCommerce versions = 1.1.4...

UBUNTU-CVE-2025-22073

In the Linux kernel, the following vulnerability has been resolved: spufs: fix a leak on spufsnewfile failure It's called from spufsfilldir, and caller of that will do spufsrmdir in case of failure. That does remove everything we'd managed to create, but... the problem dentry is still negative...

UBUNTU-CVE-2025-22071

In the Linux kernel, the following vulnerability has been resolved: spufs: fix a leak in spufscreatecontext Leak fixes back in 2008 missed one case - if we are trying to set affinity and spufsmkdir fails, we need to drop the reference to neighbor...

CVE-2025-22058

CVE-2025-22058 affects the Linux kernel UDP memory accounting. When INT_MAX was used for SO_RCVBUF, an overflow in udp_rmem_release() could wrap the total UDP memory, causing memory accounting to double after socket close and potentially leading to packet drops once rmem_alloc exceeded net.ipv4.u...

crossbeam-channel Vulnerable to Double Free on Drop

The internal Channel type's Drop method has a race which could, in some circumstances, lead to a double-free. This could result in memory corruption. Quoting from the upstream description in merge request \1187: The problem lies in the fact that dicardallmessages contained two paths that could le...

CVE-2025-32236

CVE-2025-32236 is a publicly listed Missing Authorization vulnerability affecting the plugin “Vagonic Woocommerce Products Reorder Drag Drop Multiple Sort” for WooCommerce, impacting versions from n/a up to 1.9. The issue is described as an unauthorized access flaw in the product reordering/sorti...

WordPress plugin Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic 安全漏洞

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. WordPress plugin Products Reorder Drag Drop Multiple Sort - Sortable, Rearrange Products ...

PT-2025-15954 · WordPress · Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable

Name of the Vulnerable Software and Affected Versions: Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic versions 1.9 and earlier Description: The issue is related to a Missing Authorization vulnerability. This vulnerability affects the Woocommerce Produc...

tcp: drop secpath at the same time as we currently drop dst

...

drop_monitor: fix incorrect initialization order

...

crossbeam-channel: double free on Drop

The internal Channel type's Drop method has a race which could, in some circumstances, lead to a double-free. This could result in memory corruption. Quoting from the upstream description in merge request \1187: The problem lies in the fact that dicardallmessages contained two paths that could le...

WordPress plugin Drag and Drop Multiple File Upload for WooCommerce 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

SUSE CVE-2025-21935

In the Linux kernel, the following vulnerability has been resolved: rapidio: add check for rioaddnet in rioscanallocnet The return value of rioaddnet should be checked. If it fails, putdevice should be called to free the memory and give up the reference initialized in rioaddnet...

SUSE CVE-2025-21903

In the Linux kernel, the following vulnerability has been resolved: mctp i3c: handle NULL header address daddr can be NULL if there is no neighbour table entry present, in that case the tx packet should be dropped. saddr will usually be set by MCTP core, but check for NULL in case a packet is...

DEBIAN-CVE-2025-21903

In the Linux kernel, the following vulnerability has been resolved: mctp i3c: handle NULL header address daddr can be NULL if there is no neighbour table entry present, in that case the tx packet should be dropped. saddr will usually be set by MCTP core, but check for NULL in case a packet is...

UBUNTU-CVE-2025-21935

In the Linux kernel, the following vulnerability has been resolved: rapidio: add check for rioaddnet in rioscanallocnet The return value of rioaddnet should be checked. If it fails, putdevice should be called to free the memory and give up the reference initialized in rioaddnet...

UBUNTU-CVE-2025-21903

In the Linux kernel, the following vulnerability has been resolved: mctp i3c: handle NULL header address daddr can be NULL if there is no neighbour table entry present, in that case the tx packet should be dropped. saddr will usually be set by MCTP core, but check for NULL in case a packet is...

CVE-2025-21903 mctp i3c: handle NULL header address

In the Linux kernel, the following vulnerability has been resolved: mctp i3c: handle NULL header address daddr can be NULL if there is no neighbour table entry present, in that case the tx packet should be dropped. saddr will usually be set by MCTP core, but check for NULL in case a packet is...