Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989572)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989572 advisory. In the Linux kernel, the following vulnerability has been resolved: rtnetlink: make sure to refresh masterdev/mops in rtnlnewlink While looking at one unrelated syzb...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990326)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990326 advisory. In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix miss free initdynaddr at i3cmasterputi3caddrs if dev-boardinfo &&...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989396)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989396 advisory. In the Linux kernel, the following vulnerability has been resolved: drm: Fix use-after-free read in drmgetunique There is a time-of-check-to-time-of-use error in...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989619)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989619 advisory. In the Linux kernel, the following vulnerability has been resolved: fscrypt: stop using keyrings subsystem for fscryptmasterkey The approach of fs/crypto/ internally...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989483)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989483 advisory. In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035i2cmasterxfer In af9035i2cmasterxfer, msg ...

WordPress Master Blocks plugin <= 1.4.1.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary plugin Upload vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary plugin Upload vulnerability discovered by theviper17y in WordPress Plugin Master Blocks versions = 1.4.1.3...

SUSE CVE-2025-40068

In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: Fix integer overflow in rununpack The MFT record relative to the file being opened contains its runlist, an array containing information about the file's location on the physical disk. Analysis of all Call Stack paths...

PT-2025-44289

Name of the Vulnerable Software and Affected Versions Jenkins Azure CLI Plugin versions 0.9 and earlier Description The Jenkins Azure CLI Plugin does not restrict the commands it executes on the Jenkins controller. This allows attackers with Item/Configure permission to execute arbitrary shell...

AZL-68933 CVE-2025-40068 affecting package kernel for versions less than 6.6.112.1-2

In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: Fix integer overflow in rununpack The MFT record relative to the file being opened contains its runlist, an array containing information about the file's location on the physical disk. Analysis of all Call Stack paths...

CVE-2025-40068

CVE-2025-40068 is a Linux kernel issue in the NTFS3 run_unpack() path where the MFT runlist values could overflow during decoding. This comes from unvalidated runlist data, potentially allowing access to arbitrary disk data or data destruction. The issue note confirms an overflow check for additi...

CVE-2025-40068 fs: ntfs3: Fix integer overflow in run_unpack()

In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: Fix integer overflow in rununpack The MFT record relative to the file being opened contains its runlist, an array containing information about the file's location on the physical disk. Analysis of all Call Stack paths...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the endpoint parameter in Headless API. An attacker can perform unauthorized actions by tricking a user into making unintended requests. Remediation A fix was pushed into the master branch but not yet...

Division by zero

Overview Affected versions of this package are vulnerable to Division by zero via the CLAHEImage function in MagickCore/enhance.c. An attacker can cause the process to crash or exhaust system resources by supplying crafted parameters or very small images that result in zero tile dimensions, leadi...

WordPress Master Slider Pro plugin <= 3.7.12 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Master Slider Pro versions = 3.7.12...

Linux Distros Unpatched Vulnerability : CVE-2023-53715

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex Apparently the hex passphrase mechanism does not work on newer chips/firmware e.g. BCM4387. It...

Pwn2Own Ireland 2025: The Hacks, The Winners, and The Big Payouts

Hackers earned over $1 million at Pwn2Own Ireland 2025 in Cork, breaching printers, routers, NAS devices, and more as Summoning Team claimed Master of Pwn...

CVE-2025-53426

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bob Likert Survey Master likert-survey-master allows Reflected XSS.This issue affects Likert Survey Master: from n/a through = 0.8.0.1...

Predictable Seed in Pseudo-Random Number Generator (PRNG)

Overview Affected versions of this package are vulnerable to Predictable Seed in Pseudo-Random Number Generator PRNG via the use of RandomStringUtils with the default java.util.Random PRNG. An attacker can recover sensitive information by predicting the server-side encryption key if they can obta...

Predictable Seed in Pseudo-Random Number Generator (PRNG)

Overview Affected versions of this package are vulnerable to Predictable Seed in Pseudo-Random Number Generator PRNG via the use of RandomStringUtils with the default java.util.Random PRNG. An attacker can recover sensitive information by predicting the server-side encryption key if they can obta...

EUVD-2025-35457

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bob Likert Survey Master likert-survey-master allows Reflected XSS.This issue affects Likert Survey Master: from n/a through = 0.8.0.1...