PT-2025-30013 · Grafana +1 · Grafana Oss +1

Name of the Vulnerable Software and Affected Versions: Grafana OSS affected versions not specified Description: An open redirect issue exists in the organization switching functionality of Grafana OSS. Successful exploitation requires multiple organizations to be present within the Grafana instan...

OSV-2025-449 Heap-buffer-overflow in check_content_type_and_change_protocol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=422832557 Crash type: Heap-buffer-overflow READ 11 Crash state: checkcontenttypeandchangeprotocol processrequest ndpicheckhttptcp...

PT-2025-26263 · Git +1 · Ndpi

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. affected versions not specified Description: The issue involves a heap-buffer-overflow read vulnerability. The crash state indicates the following function call sequence: check content type and change...

OSV-2025-447 Use-of-uninitialized-value in spvtools::EmitNumericLiteral

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=423059200 Crash type: Use-of-uninitialized-value Crash state: spvtools::EmitNumericLiteral spvtools::disassemble::InstructionDisassembler::EmitOperand spvtools::disassemble::InstructionDisassembler::EmitInstructionImpl...

SUSE CVE-2025-48060

jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function jvstringvfmt in the jqfuzzexecute harness from oss-fuzz. This crash happens on file jv.c, line 1456 void p = mallocsz;. As of time of publication, no patched versions are...

OSV-2024-1446 Segv on unknown address in glslang::TIntermediate::addSymbol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=422517700 Crash type: Segv on unknown address Crash state: glslang::TIntermediate::addSymbol glslang::HlslParseContext::handleFunctionCall glslang::HlslParseContext::transformEntryPoint...

OSV-2025-442 Security exception in org.jsoup.parser.HtmlTreeBuilder.process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=422516687 Crash type: Security exception Crash state: org.jsoup.parser.HtmlTreeBuilder.process org.jsoup.parser.HtmlTreeBuilderState$8.process org.jsoup.parser.TreeBuilder.currentElement...

OSV-2025-433 Null-dereference READ in _libssh2_packet_add

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=422217191 Crash type: Null-dereference READ Crash state: libssh2packetadd fullpacket libssh2transportread...

PT-2025-33603 · Git · Graphql-Java

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=422217211 Crash type: Security exception Crash state: graphql.parser.GraphqlAntlrToLanguage.createNonNullType graphql.parser.GraphqlAntlrToLanguage.createType graphql.parser.GraphqlAntlrToLanguage.createListType...

OSV-2025-419 Security exception in org.apache.lucene.util.AttributeImpl.clone

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420955259 Crash type: Security exception Crash state: org.apache.lucene.util.AttributeImpl.clone org.apache.lucene.util.AttributeSource$State.clone org.apache.lucene.util.AttributeSource$State.clone...

PT-2025-25487 · Git +1 · Lucene

Name of the Vulnerable Software and Affected Versions: Apache Lucene affected versions not specified Description: The software experiences a security exception during the cloning process within the org.apache.lucene.util.AttributeImpl and org.apache.lucene.util.AttributeSource$State classes. The...

OSV-2025-412 UNKNOWN WRITE in luaL_newstate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420248727 Crash type: UNKNOWN WRITE Crash state: luaLnewstate...

PT-2025-24333 · Git +1 · Tarantool

Name of the Vulnerable Software and Affected Versions: Lua affected versions not specified Description: The software is susceptible to an unknown write issue triggered during the luaL newstate function call. Recommendations: At the moment, there is no information about a newer version that contai...

OSV-2025-409 Heap-buffer-overflow in libodbc.so.2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420248718 Crash type: Heap-buffer-overflow READ 9 Crash state: libodbc.so.2 libodbc.so.2 libodbc.so.2...

OSV-2025-408 Heap-buffer-overflow in sav_parse_long_variable_names_record

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420198855 Crash type: Heap-buffer-overflow READ 1 Crash state: savparselongvariablenamesrecord savparserecordspass2 readstatparsesav...

OSV-2025-406 Security exception in com.puppycrawl.tools.checkstyle.JavaAstVisitor.getInnerBopAst

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420197344 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.JavaAstVisitor.getInnerBopAst java.base/java.util.stream.ReferencePipeline$3$1.accept...

PT-2025-23994 · Git +1 · Checkstyle

Name of the Vulnerable Software and Affected Versions: Checkstyle affected versions not specified Description: The software experiences a security exception during the getInnerBopAst function within the com.puppycrawl.tools.checkstyle.JavaAstVisitor class. This issue is triggered during stream...

PT-2025-23995 · Git +1 · Readstat

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. affected versions not specified Description: The software contains a heap-buffer-overflow read issue. The crash occurs during the sav parse long variable names record function, which is called by sav par...

CVE-2025-3580

An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint. The vulnerability can be exploited when: 1. An Organization administrator...

CVE-2025-3580

CVE-2025-3580 (Grafana Open Source) : An access-control flaw in the DELETE /api/org/users/ endpoint allows an Organization administrator to permanently delete the Server administrator account. If the sole Server admin is deleted, the Grafana instance becomes unmanageable with no super-user permis...