com.vaadin:vaadin (>=24.9.0 <=24.9.18) potentially affected by CVE-2025-15022 via com.vaadin:vaadin-spreadsheet-flow (>=24.9.0 <=24.9.5)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.9.0, =24.9.0, =24.9.18 Source cves: CVE-2025-15022 Source advisory: SNYK:JAVA-COMVAADIN-14860869...

com.vaadin:vaadin (>=23.1.0 <=23.1.17), com.vaadin:vaadin-jandex (>=23.1.0 <=23.1.17) +2 more potentially affected by CVE-2025-15022 via com.vaadin:vaadin-spreadsheet-flow (>=23.1.0 <=23.1.9)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =23.1.0, =23.1.0, =23.1.0, =23.1.0, =2.5.2, =2.5.3 Source cves: CVE-2025-15022 Source advisory: SNYK:JAVA-COMVAADIN-14860869...

CVE-2025-15022

CVE-2025-15022 describes an XSS vulnerability in Vaadin where caption HTML was not sanitized. Affected are Vaadin Framework 7 (7.0.0–7.7.49) and 8 (8.0.0–8.29.1), as well as Vaadin 23.1.0–23.6.5, Vaadin 24.0.0–24.8.13, and Vaadin 24.9.0–24.9.6. Fixed versions sanitize captions by default and, for...

CVE-2025-15419 Open5GS GTPv2-C Flow s5c-handler.c sgwc_s5c_handle_create_session_response denial of service

A weakness has been identified in Open5GS up to 2.7.6. Affected by this issue is the function sgwcs5chandlecreatesessionresponse of the file src/sgwc/s5c-handler.c of the component GTPv2-C Flow Handler. Executing a manipulation can lead to denial of service. The attack needs to be launched locall...

CVE-2025-15419

Open5GS up to version 2.7.6 is affected by a vulnerability in the GTPv2-C Flow Handler, specifically the function sgwc_s5c_handle_create_session_response in src/sgwc/s5c-handler.c. Manipulation can cause a local denial of service. The attack requires local access, and public exploits are availabl...

CVE-2025-15419 Open5GS GTPv2-C Flow s5c-handler.c sgwc_s5c_handle_create_session_response denial of service

A weakness has been identified in Open5GS up to 2.7.6. Affected by this issue is the function sgwcs5chandlecreatesessionresponse of the file src/sgwc/s5c-handler.c of the component GTPv2-C Flow Handler. Executing a manipulation can lead to denial of service. The attack needs to be launched locall...

Exploit for Cross-site Scripting in Warfareplugins Social_Warfare

CVE-2019-9978-RCE-PoC A custom Pytho...

PT-2026-5527

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the flow steering list when a kernel module is removed while active entries are present. The flow steering list manages entries created and deleted as flow steeri...

PT-2026-8121

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 6.6.98-android15-8-g0b1d2aee7fc3 Description The Linux kernel contains a flaw in the arm64 architecture related to Control Flow Integrity CFI. A Data Abort DABT can occur on Android-based systems during resume fr...

PT-2026-8112

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to network packet dissection. Specifically, the issue arises because a network pointer was not provided to the skb flow dissect function after a...

CVE-2025-69286

RAGFlow is an open-source RAG Retrieval-Augmented Generation engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta assistant/agent share auth token generation process allows these tokens to be mutually derivable. Specifically, both tokens are...

CVE-2023-54240

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: fix possible NULL pointer dereference in mtkhwlrogetfdirall rulelocs is allocated in ethtoolgetrxnfc and the size is determined by rulecnt from user space. So rulecnt needs to be check before using...

CVE-2023-54262

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Don't clone flow post action attributes second time The code already clones post action attributes in mlx5ecloneflowattrforpostact. Creating another copy in mlx5etcpostactadd is a erroneous leftover from original...

CVE-2025-14783

CVE-2025-14783 affects WordPress Easy Digital Downloads (versions ≤ 3.6.2). Root cause: unvalidated redirect in the edd_redirect parameter during password-reset flow, enabling unauthenticated users to coax recipients into visiting malicious sites. Exploitation: a PoC exists on GitHub (ZeroEthical...

SUSE CVE-2022-50844

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix type of second parameter in odneditdpmtable callback With clang's kernel control flow integrity kCFI, CONFIGCFICLANG, indirect call targets are validated against the expected function pointer prototype to make sur...

SUSE CVE-2023-54193

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: remove blockcb from driverlist before freeing Error handler of tcfblockbind frees the whole bo-cblist on error. However, by that time the flowblockcb instances are already in the driver list because driver...

SUSE CVE-2023-54262

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Don't clone flow post action attributes second time The code already clones post action attributes in mlx5ecloneflowattrforpostact. Creating another copy in mlx5etcpostactadd is a erroneous leftover from original...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992959)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992959 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/sti: Fix return type of stidvo,hda,hdmiconnectormodevalid With clang's kernel control flow...

Linux Distros Unpatched Vulnerability : CVE-2023-54262

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/mlx5e: Don't clone flow post action attributes second time The code already clones post action attributes in mlx5ecloneflowattrforpostact. Creating another...

Linux Distros Unpatched Vulnerability : CVE-2023-54193

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: clsapi: remove blockcb from driverlist before freeing Error handler of tcfblockbind frees the whole bo-cblist on error. However, by that time the...