CVE-2025-8862

YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. To mitigate this, we recommend upgrading the database to a version where this information is properly redacted. Mitigation Mitigation for this issue is either not...

CVE-2025-8864

Shared Access Signature token is not masked in the backup configuration response and is also exposed in the ybbackup logs Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and...

CVE-2025-8863

YugabyteDB diagnostic information was transmitted over HTTP, which could expose sensitive data during transmission Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deploymen...

BIT-PYTHON-2025-8194 Tarfile infinite loop during parsing with negative member offset

There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives...

Linux Distros Unpatched Vulnerability : CVE-2025-37948

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs A malicious BPF program may manipulate the branch history to influence what the hardware...

Exploit for Incorrect Authorization in Sudo_Project Sudo

sudo CVE-2025 Toolkit Unified scanner, benign proof-of-...

Linux Distros Unpatched Vulnerability : CVE-2024-58000

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: iouring: prevent reg-wait speculations With ENTEREXTARGREG instead of passing a user pointer...

Exploit for Inclusion of Functionality from Untrusted Control Sphere in Sudo_Project Sudo

Sudo CVE-2025-32463 — PoC !GitHub last commithttps://img.s...

Linux Distros Unpatched Vulnerability : CVE-2025-37963

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users Support for eBPF programs loaded by unprivileged users is typically disabled. This means on...

CVE-2025-54368

A flaw was found in uv. The package's handling of remote ZIP archives processes entries sequentially without verifying them against the archive's central directory. This vulnerability allows a remote attacker to craft a malicious ZIP archive that can cause unexpected behavior when processed...

CVE-2025-47808

A flaw was found in gstreamer1-plugins-base. The subparse plugin's tmplayerparseline function incorrectly attempts to dereference a NULL pointer during subtitle file parsing. This flaw allows a local attacker to provide a specially crafted subtitle file, causing the program to crash. Mitigation...

CVE-2025-47219

A flaw was found in gstreamer1-plugins-good. The isomp4 plugin's qtdemuxparsetrak function incorrectly handles MP4 file parsing, resulting in a heap buffer over-read. This flaw allows a local attacker to provide a specially crafted MP4 file. This over-read can lead to information disclosure...

CLSA-2025-1754650455 tomcat: Fix of CVE-2024-56337

CVE-2024-56337: prevent time-of-check time-of-use TOCTOU race condition vulnerability by strengthening file validation logic during request handling and closing the gap left by the partial mitigation in CVE‑2024‑50379...

CVE-2025-45765

A flaw was found in ruby-jwt. The library does not enforce minimum key sizes for encryption, allowing the use of weak keys that may be vulnerable to decryption. A malicious actor can leverage this lack of enforcement to compromise the confidentiality of data protected by the library. This can...

CVE-2025-54886

A flaw was found in skops. The Card.getmodel function allows arbitrary code execution due to a lack of input validation, allowing a local attacker to trigger this vulnerability. This issue occurs when processing a malicious job file, leading to potential arbitrary code execution on the affected...

CVE-2025-44779

An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use an...

CVE-2025-50952

A null pointer dereference vulnerability has been discovered in the openjpeg library. This flaw, identified through a fuzzing tool, could allow an attacker to cause a crash in an application processing a specially crafted file. While no active exploit has been demonstrated, a successful attack...

MINI-P9QJ-FVMG-RJMW

Bulletin has no description...

CVE-2025-54798

A flaw was found in tmp. The tmp module, used for creating temporary files and directories in Node.js, allows an arbitrary temporary file or directory write due to insufficient validation of the symbolic link parameter. This vulnerability allows a local attacker to provide a crafted symbolic link...

CVE-2025-47908

A flaw was found in github.com/rs/cors. The middleware exhibits excessive heap memory allocation when handling preflight requests containing a lengthy, comma-separated value in the Access-Control-Request-Headers ACRH header. This vulnerability allows an attacker to send a specially crafted HTTP...