RHEL 9 : jq (RHSA-2025:10585)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10585 advisory. jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or...

Ubuntu 25.04 : Linux kernel vulnerabilities (USN-7611-1)

The remote Ubuntu 25.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7611-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the...

CVE-2025-3264

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library. This vulnerability may allow an attacker to induce a denial of service in the application using the Transformers library. Mitigation Mitigation for this issue is either not availabl...

CVE-2025-5987

A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with th...

CVE-2025-6714 Incorrect Handling of incomplete data may prevent mongoS from Accepting New Connections

MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data. This affects MongoDB when configured with load balancer support. This issue affects MongoDB Server v6.0 prior to 6.0.23, MongoDB Server v7.0 prior to 7.0.20 and MongoDB Serve...

CVE-2025-5987

CVE-2025-5987 affects libssh when using ChaCha20 with OpenSSL. Root cause: OpenSSL error codes alias with SSH_OK, causing libssh to miss detection of an error during ChaCha20-Poly1305 key setup, potentially leading to a partially initialized cipher context and undefined behavior that can compromi...

SUSE-SU-2025:02232-1 Security update for python39

This update for python39 fixes the following issues: - CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser bsc1244705...

kernel: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix malformed packet sizing in vmxnet3processxdp vmxnet3 driver's XDP handling is buggy for packet sizes using ring0 that is, packet sizes between 128 - 3k bytes. We noticed MTU-related connectivity issues with Cilium's...

Important: Red Hat Security Advisory: pam security update

An update for pam is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

webkitgtk: Loading a malicious iframe may lead to a cross-site scripting attack

A flaw was found in WebKitGTK. Loading a malicious iframe can cause a cross-site scripting attack due to permissions issues...

The vulnerability of the gpiolib-cdev.c component in the Linux operating system allows a hacker to exploit it and cause service failures.

The vulnerability of the gpiolib-cdev.c component in the Linux operating system is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to cause service failures...

RHEL 8 : xorg-x11-server-Xwayland (RHSA-2025:10346)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:10346 advisory. Xwayland is an X server for running X clients under Wayland. Security Fixes: xorg-x11-server-Xwayland: xorg-x11-server: tigervnc:...

RHEL 7 : webkitgtk4 (RHSA-2025:10364)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10364 advisory. WebKitGTK+ is port of the WebKit portable web rendering engine to the GTK+ platform. These packages provide WebKitGTK+ for GTK+ 3. Security...

PT-2025-28234 · Splunk · Splunk Enterprise

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.4.3 Splunk Enterprise versions prior to 9.3.5 Splunk Enterprise versions prior to 9.2.7 Splunk Enterprise versions prior to 9.1.10 Description: A low-privileged user without the "admin" or "power" Splunk...

PT-2025-28180

Name of the Vulnerable Software and Affected Versions: MongoDB Server versions 6.0 prior to 6.0.23 MongoDB Server versions 7.0 prior to 7.0.20 MongoDB Server versions 8.0 prior to 8.0.9 Description: The issue affects MongoDB Server's mongos component, causing it to become unresponsive to new...

libmozjs-128-0-128.12.0-1.1 on GA media (moderate)

libmozjs-128-0-128.12.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:15315-1 Rating: moderate Cross-References: CVE-2025-5263 CVE-2025-5264 CVE-2025-5265 CVE-2025-5266 CVE-2025-5267 CVE-2025-5268 CVE-2025-5269 CVE-2025-5283 CVE-2025-6424 CVE-2025-6425 CVE-2025-6426 CVE-2025-6429 CVE-2025-643...

FreeBSD : firefox -- multiple vulnerabilities (9bad6f79-58cf-11f0-b4ad-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 9bad6f79-58cf-11f0-b4ad-b42e991fc52e advisory. [email protected] reports: Firefox could have incorrectly parsed a URL and rewritten it to...

CVE-2025-38225

In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Cleanup after an allocation error When allocation failures are not cleaned up by the driver, further allocation errors will be false-positives, which will cause buffers to remain uninitialized and cause NULL...

CVE-2025-46733

OP-TEE is a Trusted Execution Environment TEE designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. In version 4.5.0, using a specially crafted tee-supplicant binary running in REE userspace, an attacker can trigger a panic in a TA that...

CVE-2025-28957

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in OwnerRez OwnerRez API ownerrez allows Stored XSS.This issue affects OwnerRez API: from n/a through = 1.2.1...