CVE-2025-6545

A flaw was found in the npm pbkdf2 library, allowing signature spoofing. When executing in javascript engines other than Nodejs or Nodejs when importing pbkdf2/browser, certain algorithms will silently fail and return invalid data. The return values are predictable, which undermines the security...

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

...

CVE-2025-6499

A flaw was found in libucl. The uclparsemultilinestring function in src/uclparser.c is vulnerable to a heap-based buffer overflow due to improper bounds checking during multiline string parsing. This flaw allows a local attacker to trigger this overflow by providing a specially crafted input file...

The vulnerability of the mptcp_get_options() function in the net/mptcp/options.c module, which is part of the Linux kernel’s networking functions, allows a hacker to cause a service failure.

The vulnerability of the mptcpgetoptions function in the net/mptcp/options.c module, which implements networking functions in the Linux kernel, relates to reading beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the cifs_compose_mount_options() function in the fs/cifs/cifs_dfs_ref.c module of the Linux kernel file system allows a hacker to cause a service failure.

The vulnerability of the cifscomposemountoptions function in the fs/cifs/cifsdfsref.c module of the Linux file system support module is related to the use of a NULL pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2025-6275

A use-after-free vulnerability has been discovered in WebAssembly's WebAssembly Binary Toolkit wabt, specifically within the GetFuncOffset function. This flaw can be triggered by an attacker with local system access through the manipulation of input provided to this function. Successful...

CVE-2025-4563

A flaw was found in the Kubernetes NodeRestriction admission controller when the DynamicResourceAllocation feature is enabled. While this controller properly validates resource claims during pod status updates, it fails to apply the same validation during pod creation. This oversight allows a...

Security update for systemd

This update for systemd fixes the following issues: CVE-2025-4598: Race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dump bsc1243935. CVE-2023-26604: Privilege escalation via the less pager bsc1208958. CVE-2022-4415: systemd-coredump wa...

CVE-2025-50181

A flaw was found in urllib3. The PoolManager class allows redirects to be disabled by configuring retries in a specific manner, effectively bypassing intended HTTP redirection behavior. A network attacker can leverage this configuration to manipulate request flows and disrupt service. This bypass...

CVE-2025-50182

A flaw was found in urllib3. The library fails to properly validate redirect URLs, allowing an attacker to manipulate redirect chains when used in environments like Pyodide utilizing the JavaScript Fetch API. This lack of validation can enable a remote attacker to control the redirect destination...

CVE-2025-6192

A use after free flaw has been discovered in Google Chrome. This flaw may allow an attacker to trigger heap corruption via a crafted HTML page. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria...

USN-7577-2 libblockdev vulnerability

USN-7577-1 fixed a vulnerability in libblockdev. This update provides the corresponding update for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that libblockdev incorrectly handled mount options when resizing certain filesystems. A local attacker with an...

CVE-2025-6220

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveoptions' function in all versions up to, and including, 3.5.12. This makes it possible for authenticated attackers, with Administrator-level access and...

USN-7578-1 udisks2 vulnerability

It was discovered that UDisks incorrectly handled mount options when resizing certain filesystems. A local attacker with an active session on the console can use this issue to escalate their privileges to root...

USN-7578-1: UDisks vulnerability

It was discovered that UDisks incorrectly handled mount options when resizing certain filesystems. A local attacker with an active session on the console can use this issue to escalate their privileges to root...

USN-7577-1: libblockdev vulnerability

It was discovered that libblockdev incorrectly handled mount options when resizing certain filesystems. A local attacker with an active session on the console can use this issue to escalate their privileges to root...

USN-7577-1 libblockdev vulnerability

It was discovered that libblockdev incorrectly handled mount options when resizing certain filesystems. A local attacker with an active session on the console can use this issue to escalate their privileges to root...

CVE-2025-49176

A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check. Mitigation Mitigation for this issue is either not available or the currently available...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Fixed the issue of tracepoints being reset upon removal of the timerlat tracer. If a timerlat tracer is started with the osnoise option OSNOISEWORKLOAD disabled, but then that option is enabled again and the...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: netfs: Only create /proc/fs/netfs with CONFIGPROCFS enabled. When testing a special configuration: CONFIGNETFSSUPPORTS=y CONFIGPROCFS=n The system crashes with something like: 3.766197 ------------ Cut here ------------ 3.766484...