kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts

In the Linux kernel, the following vulnerability has been resolved: sched: schcake: add bounds checks to host bulk flow fairness counts Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host bulk flow counters, leading to an out ...

PT-2025-46353

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 145 Firefox ESR versions prior to 140.5 Firefox ESR versions prior to 115.30 Description A mitigation bypass exists in the DOM: Core & HTML component. This issue could allow for bypassing security mitigations...

Security Vulnerabilities fixed in Firefox ESR 140.5 — Mozilla

CVE-2025-13012: Race condition in the Graphics component Reporter Irvan Kurniawan Impact high References Bug 1991458 CVE-2025-13016: Incorrect boundary conditions in the JavaScript: WebAssembly component Reporter Igor Morgenstern Impact high References Bug 1992130 CVE-2025-13017: Same-origin poli...

Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2025-20558)

The remote Oracle Linux 10 / 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20558 advisory. 6.12.0-103.40.4.2.el10uek - x86/vmscape: Warn when STIBP is disabled with SMT Pawan Gupta Orabug: 38343659 - x86/bugs: Move cpubugssmtupdate down Pawan...

Intel® Killer™ Software Advisory

Summary: A potential security vulnerability for some Intel® Killer™ Software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2025-24491 Description: Uncontrolled search path for some Intel® Killer™...

Oracle Linux 10 : kernel (ELSA-2025-19962)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-19962 advisory. - wifi: cfg80211: fix use-after-free in cmpbss CKI Backport Bot RHEL-122878 CVE-2025-39864 - arm64: bpf: Only mitigate cBPF programs loaded by...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2025-20560)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20560 advisory. 5.4.17-2136.347.6.1 - x86/vmscape: Warn when STIBP is disabled with SMT Pawan Gupta Orabug: 38343661 - x86/bugs: Move cpubugssmtupdate down Pawan Gupta...

Oracle Linux 9 : kernel (ELSA-2025-19930)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-19930 advisory. - x86/vmscape: Add old Intel CPUs to affected list Waiman Long RHEL-114270 CVE-2025-40300 - x86/vmscape: Warn when STIBP is disabled with SMT Waiman...

Oracle Linux 8 : kernel (ELSA-2025-19931)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-19931 advisory. - fs: fix UAF/GPF bug in nilfsmdtdestroy Abhi Das RHEL-116658 CVE-2022-50367 - x86/vmscape: Add old Intel CPUs to affected list Waiman Long RHEL-11428...

Mozilla Firefox和Mozilla Firefox ESR 安全漏洞

Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox web browser. A security bypass vulnerability exists in Mozilla Firefox and Firefox ESR, which can be exploited by attackers to bypass security restrictions...

Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2025-20559)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20559 advisory. 5.15.0-312.187.5.1 - x86/vmscape: Warn when STIBP is disabled with SMT Pawan Gupta Orabug: 38343660 - x86/bugs: Move cpubugssmtupdate down Pawan Gupta...

firefox -- Use-after-free

https://bugzilla.mozilla.org/showbug.cgi?id=1995686 reports: Use-after-free in the WebRTC: Audio/Video component. Same-origin policy bypass in the DOM: Workers component. Mitigation bypass in the DOM: Security component. Same-origin policy bypass in the DOM: Notifications component. Incorrect...

AlmaLinux 8 : kernel-rt (ALSA-2025:19932)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:19932 advisory. kernel: x86/vmscape: Add conditional IBPB mitigation CVE-2025-40300 kernel: mm: fix zswap writeback race condition CVE-2023-53178 kernel: fs: fix UAF/GPF...

CVE-2025-64513

Milvus is an open-source vector database built for generative AI applications. An unauthenticated attacker can exploit a vulnerability in versions prior to 2.4.24, 2.5.21, and 2.6.5 to bypass all authentication mechanisms in the Milvus Proxy component, gaining full administrative access to the...

CVE-2025-64513 Milvus Proxy has Critical Authentication Bypass Vulnerability

Milvus is an open-source vector database built for generative AI applications. An unauthenticated attacker can exploit a vulnerability in versions prior to 2.4.24, 2.5.21, and 2.6.5 to bypass all authentication mechanisms in the Milvus Proxy component, gaining full administrative access to the...

CVE-2025-64513

CVE-2025-64513 describes a critical authentication bypass in the Milvus Proxy component of Milvus. An unauthenticated attacker can bypass all authentication, gaining full administrative access to the Milvus cluster, with read/modify/delete of data and privileged operations such as database or col...

CVE-2025-64513 Milvus Proxy has Critical Authentication Bypass Vulnerability

Milvus is an open-source vector database built for generative AI applications. An unauthenticated attacker can exploit a vulnerability in versions prior to 2.4.24, 2.5.21, and 2.6.5 to bypass all authentication mechanisms in the Milvus Proxy component, gaining full administrative access to the...

CVE-2025-59777

NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service DoS...

CVE-2025-12155

CVE-2025-12155 describes a Command Injection in Looker caused by improper file path sanitization (Directory Traversal). The vulnerability allows an attacker with Developer permission to execute arbitrary shell commands when a user is deleted on the host system. Affected products are Looker (both ...

Moderate: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...