CVE-2022-50562

CVE-2022-50562 : In the Linux kernel, the TPM ACPI path leaked memory because acpi_get_table() was not paired with acpi_put_table(). The fix adds acpi_put_table() to release ACPI memory and also removes a redundant empty line in tpm_read_log_acpi(). This resolves a memory leak in the TPM2/TCPA ev...

PT-2026-2552

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's ext4 implementation related to extended attribute handling. Specifically, a null pointer dereference can occur within the ext4 raw inode function if...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a resource leak in the mt7915ratetxpowerget function...

Moderate: java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fixes: JDK: Enhance Path Factories CVE-2025-53066 JDK: Enhance Certificate Handling CVE-2025-53057 Bug Fixes: Since the 8.8 release of AlmaLinuxand the 9.2...

CVE-2025-62597

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1, a reflected cross-site scripting XSS vulnerability was identified in the editarinfopessoal.php endpoint of the WeGIA application. This vulnerability allows attackers to inject...

EUVD-2025-35216

The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Change via crafted POST request to /getset.ccp...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987516)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987516 advisory. In the Linux kernel, the following vulnerability has been resolved: tpm: use trygetops in tpm-space.c As part of the series conversion to remove nested TPM operation...

CVE-2025-52079

The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Change via crafted POST request to /getset.ccp...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987592)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987592 advisory. In the Linux kernel, the following vulnerability has been resolved: USB: host: isp116x: check return value after calling platformgetresource It will cause...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987608)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987608 advisory. In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: out of bounds read in mtkhwlrogetfdirentry The fsp-location variable...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987700)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987700 advisory. In the Linux kernel, the following vulnerability has been resolved: rtc: mt6397: check return value after calling platformgetresource It will cause null-ptr-deref if...

thunderbird: firefox: Use-after-free in MediaTrackGraphImpl::GetInstance()

A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in MediaTrackGraphImpl::GetInstance...

EUVD-2025-35068

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix warning in smcrxsplice when calling getpage smcloregisterdmb allocates DMB buffers with kzalloc, which are later passed to getpage in smcrxsplice. Since kmalloc memory is not page-backed, this triggers WARNONONCE in...

CVE-2025-40012 net/smc: fix warning in smc_rx_splice() when calling get_page()

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix warning in smcrxsplice when calling getpage smcloregisterdmb allocates DMB buffers with kzalloc, which are later passed to getpage in smcrxsplice. Since kmalloc memory is not page-backed, this triggers WARNONONCE in...

thunderbird: firefox: Use-after-free in MediaTrackGraphImpl::GetInstance()

A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in MediaTrackGraphImpl::GetInstance...

PT-2025-42929

Name of the Vulnerable Software and Affected Versions D-Link DIR-820L version 1.06B02 Description The administrator password setting has improper access control, allowing for unverified password changes via a crafted POST request to the /get set.ccp API endpoint. The request exploits a flaw in ho...

PT-2025-45960

A buffer overflow in the fribidi get par embedding levels ex function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an...

JLSEC-2025-118 `adts_decode_extradata` in `libavformat/adtsenc.c` in FFmpeg 4.4 does not check the `init_get_bits`...

adtsdecodeextradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the initgetbits return value, which is a necessary step because the second argument to initgetbits can be crafted...

CVE-2025-47410

Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on behalf of the authenticated user. This...

PT-2025-45939

A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs...