xorg: xwayland: Out-of-bounds write in CreatePointerBarrierClient()

An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching...

AZL-60492 CVE-2025-22872 affecting package ig for versions less than 0.37.0-4

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...

The png_convert_to_rfc1123 function in png.c allows remote attackers to obtain sensitive process memory information

...

Heap-based Buffer Overflow

Overview org.graalvm.sdk:graal-sdk is a high-performance JDK distribution designed to accelerate the execution of applications written in Java and other JVM languages along with support for JavaScript, Ruby, Python, and a number of other popular languages. Affected versions of this package are...

Vulnerability of the smu_v13_0_update_pcie_parameters() function in the drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c module – This driver supports AMD graphics card Direct Rendering Infrastructure (DRI) in Linux operating systems. It can be exploited by attackers to compromise the confidentiality, integrity, and accessibility of protected information.

Vulnerability of the smuv130updatepcieparameters function in the drivers/gpu/drm/amd/pm/swsmu/smu13/smuv130.c module – The driver that supports Direct Rendering Infrastructure DRI for AMD graphics cards in Linux operating systems has a unvalidated array indexing issue. Exploiting this vulnerabili...

The vulnerability in the kernel implementation of NVIDIA GeForce, Quadro, NVS, and Tesla graphics processors allows a hacker to cause service failures.

The vulnerability of the kernel-based implementations of NVIDIA GeForce, Quadro, NVS, and Tesla graphics processors is related to pointer dereferencing errors. Exploiting this vulnerability can allow an attacker to cause system failures...

The vulnerability in the kernel implementation of NVIDIA GeForce, Quadro, NVS, and Tesla graphics processors allows a hacker to cause service failures.

The vulnerability of the kernel-based implementations of NVIDIA GeForce, Quadro, NVS, and Tesla graphics processors is related to pointer dereferencing errors. Exploiting this vulnerability can allow an attacker to cause service failures...

The vulnerability of the kernel-level driver nvlddmkm.sys from NVIDIA’s graphics processing units, including GeForce, Quadro, NVS, and Tesla, allows attackers to cause system failures or gain unauthorized access to protected information.

The vulnerability of the kernel mode driver nvlddmkm.sys of NVIDIA’s graphics processing units, including GeForce, Quadro, NVS, and Tesla, relates to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow attackers to cause system failures, gain unauthorized...

Cross-site Scripting (XSS)

Overview krayin/laravel-crm is a hand tailored CRM framework built on some of the hottest opensource technologies such as Laravel a PHP framework and Vue.js a progressive Javascript framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the storeMedia function...

Vulnerability of the set_wm_ranges() function in the drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c file – This function is part of the driver support for Direct Rendering Infrastructure (DRI) of AMD graphics cards in Linux operating systems. It can be exploited by attackers to cause service failures.

Vulnerability of the setwmranges function in the drivers/gpu/drm/amd/display/dc/dcn301/dcn301resource.c file – The drivers for AMD graphics cards that support Direct Rendering Infrastructure DRI in Linux operating systems are vulnerable due to improper control of resource identifiers “resource...

The vulnerability of Linux operating system’s DRM/amdgpu kernel components, which allows a hacker to trigger a service failure

The vulnerability of DRM/AMDGPU cores in the Linux operating system is related to incorrect resource blocking. Exploiting this vulnerability can allow a hacker to cause service failures...

Vulnerability of the dce110_disable_stream() function in the drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c file – This is a driver for supporting Direct Rendering Infrastructure (DRI) in AMD graphics cards for Linux operating systems. It allows attackers to cause service failures.

Vulnerability of the dce110disablestream function in the drivers/gpu/drm/amd/display/dc/dce110/dce110hwsequencer.c module – The driver for AMD GPU Direct Rendering Infrastructure in Linux operating systems is vulnerable to uncontrolled resource consumption. Exploiting this vulnerability could all...

Vulnerability of the function dcn35_clk_mgr_helper_populate_bw_params() in the module drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c – A driver for supporting Direct Rendering Infrastructure (DRI) in AMD graphics cards with Linux operating systems. This vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information.

Vulnerability of the function dcn35clkmgrhelperpopulatebwparams in the module drivers/gpu/drm/amd/display/dc/clkmgr/dcn35/dcn35clkmgr.c – Drivers supporting Direct Rendering Infrastructure DRI for AMD graphics cards with Linux operating systems have a unvalidated array indexing issue. Exploiting...

Vulnerability of the drm_dev_enter() function in the Linux operating system, allowing a hacker to trigger a service failure

The vulnerability of the drmdeventer function in the Linux operating system is related to the operation of writing data beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

CVE-2025-2575

The Z Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to...

UBUNTU-CVE-2025-32807

A path traversal vulnerability in FusionDirectory before 1.5 allows remote attackers to read arbitrary files on the host that end with .png and .svg or .xpm for some configurations via the icon parameter of a GET request to geticon.php...

WordPress plugin Z Companion 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

HedgeDoc 跨站脚本漏洞

HedgeDoc is a Javascript-based real-time editing and sharing platform for Markdown documents from the HedgeDoc team. A cross-site scripting vulnerability exists in HedgeDoc versions prior to 1.10.3, which stems from a malicious SVG file that could lead to a cross-site scripting attack...

The vulnerability of the DRM/AMD/display components of the Linux operating system allows a perpetrator to influence the accessibility of protected information.

The vulnerability of the DRM/AMD/display components in the Linux operating system is related to pointer arithmetic errors. Exploiting this vulnerability could allow an attacker to influence the accessibility of protected information...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF bsc1237918. CVE-2022-49465: blk-throttle: Set BIOTHROTTLED when bio has been throttled bsc1238919...