13486 matches found
PT-2026-1358
Name of the Vulnerable Software and Affected Versions badkeys versions 0.0.15 and below Description badkeys is a tool and library used for checking cryptographic public keys for known issues. In versions 0.0.15 and below, an attacker can inject content containing ASCII control characters, such as...
[SECURITY] Fedora 42 Update: doctl-1.148.0-1.fc42
The official command line interface for the DigitalOcean API...
[SECURITY] Fedora 43 Update: doctl-1.148.0-1.fc43
The official command line interface for the DigitalOcean API...
curl: CRLF Injection in Gopher Protocol (`lib/gopher.c`)
Control characters slip through during URL handling in curlās Gopher setup. Though null bytes get blocked by the REJECTZERO setting, returns and line feeds remain permitted. A specially built address using percent-encoded breaks - like %0D%0A - opens room for command insertion. Because of how...
[SECURITY] Fedora 43 Update: gh-2.83.2-1.fc43
A command-line interface to GitHub for use in your terminal or your scripts. gh is a tool designed to enhance your workflow when working with GitHub. It provides a seamless way to interact with GitHub repositories and perform vari ous actions right from the command line, eliminating the need to...
CRLF Injection
Overview Affected versions of this package are vulnerable to CRLF Injection via the processing of untrusted HTTP headers. An attacker can access internal or external network resources by injecting carriage return and line feed characters into user-supplied headers. Remediation Upgrade cpp-httplib...
PT-2026-22158
Name of the Vulnerable Software and Affected Versions FTP GVfs backend affected versions not specified Description An input validation issue exists in the FTP GVfs backend. A remote attacker can exploit this by providing specially crafted file paths with carriage return and line feed CRLF...
PT-2026-3302
Name of the Vulnerable Software and Affected Versions Weblate wlc versions prior to 1.17.2 Description The Weblate command-line client wlc, which uses Weblate's REST API, is susceptible to an arbitrary file write issue. A crafted server can instruct the multi-translation download functionality to...
cpp-httplib ę³Øå „ę¼ę“
cpp-httplib is an HTTP/HTTPS server and client library written in C++ by the individual developer yhirose. An injection vulnerability exists in versions prior to cpp-httplib 0.30.0, which stems from a failure to check for CR and LF characters in user-supplied headers, which could lead to the...
OESA-2025-2887 kernel security update
The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3-sva: Fix mm use-after-free We currently call arm64mmcontextput without holding a reference to the mm, which can result in use-after-free. Call...
CVE-2023-54222 hte: tegra-194: Fix off by one in tegra_hte_map_to_line_id()
In the Linux kernel, the following vulnerability has been resolved: hte: tegra-194: Fix off by one in tegrahtemaptolineid The "mapsz" is the number of elements in the "m" array so the comparison needs to be changed to = to prevent an out of bounds read...
CVE-2023-54222
CVE-2023-54222 affects the Linux kernel: a bug in the Tegra hte map driver (hte: tegra-194: tegra_hte_map_to_line_id) allowed an out-of-bounds read due to an off-by-one in the size check. The root cause is that the code compared against the size of the m array with a ā>ā and needed a ā>=ā i...
CVE-2023-54222
In the Linux kernel, the following vulnerability has been resolved: hte: tegra-194: Fix off by one in tegrahtemaptolineid The "mapsz" is the number of elements in the "m" array so the comparison needs to be changed to = to prevent an out of bounds read...
SUSE CVE-2018-25153
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as the reported issue does not constitute a security vulnerability and represents a minor, non-exploitable memory leak...
SUSE CVE-2025-68972
In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds although an "invalid armor" message is printed...
PT-2025-54051
In the Linux kernel, the following vulnerability has been resolved: hte: tegra-194: Fix off by one in tegra hte map to line id The "map sz" is the number of elements in the "m" array so the comparison needs to be changed to = to prevent an out of bounds read...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-992237)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992237 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix Oops by 9.1 surround channel names getlineoutpfx may trigger an Oops by overflowin...
[SECURITY] Fedora 42 Update: fluidsynth-2.5.2-1.fc42
FluidSynth is a real-time software synthesizer based on the SoundFont 2 specifications. It is a "software synthesizer". FluidSynth can read MIDI even ts from the MIDI input device and render them to the audio device. It features real-time effect modulation using SoundFont 2.01 modulators, and a...
CVE-2025-68972
A flaw was found in GnuPG. An adversary can exploit this vulnerability by crafting a signed message that includes a form feed character \f at the end of a plaintext line. This allows the adversary to append additional, unsigned text to the message while the signature verification still reports...
