Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986558)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986558 advisory. In the Linux kernel, the following vulnerability has been resolved: net: macb: fix use after free on rmmod platdev-dev-platformdata is released by...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414559)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414559 advisory. fs/nfs/nfs4client.c in the Linux kernel before 5.13.4 has incorrect connection-setup ordering, which allows operators of remote NFSv4 servers to cause a denial of...

PT-2025-41130

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.5.0-rc7-syzkaller-gfe4469582053 Description The Linux kernel contains a flaw in the net/handshake/netlink.c component, specifically within the handshake nl done doit function. This issue can lead to a null...

PT-2025-41193

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.3.15 through 7.4.3.111 Liferay DXP versions 2023.Q4.0 through 2023.Q4.5 Liferay DXP versions 2023.Q3.1 through 2023.Q3.8 Liferay versions 7.4 update 15 through update 92 Description The software contains multiple...

CVE-2025-10162: Undefined Security Weakness

The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin before 14 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files via a path traversal attack...

CVE-2025-43822: Improper Neutralization of Input During Web Page Generation

Multiple stored cross-site scripting XSS vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 15 through update 92 allow remote attackers to inject arbitrary web script or HTML via crafted payload...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from auxiliary devices not being removed in the correct order, which could lead to reuse after release...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987306)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987306 advisory. In the Linux kernel, the following vulnerability has been resolved: XArray: Fix xascreaterange when multi-order entry present If there is already an entry present th...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987260)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987260 advisory. In the Linux kernel, the following vulnerability has been resolved: ASoC: rt5645: Fix errorenous cleanup order There is a logic error when removing rt5645 device as...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-987149)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987149 advisory. In the Linux kernel, the following vulnerability has been resolved: rtc: cmos: Fix event handler registration ordering issue Because acpiinstallfixedeventhandler...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2025-936108)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-936108 advisory. A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filterframe at libavfilter/vffieldorder.c, which might lead to memory corruption and other potenti...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987095)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987095 advisory. In the Linux kernel, the following vulnerability has been resolved: iavf: free qvectors before queues in iavfdisablevf iavffreequeues clears adapter-numactivequeues,...

PT-2025-46655

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s accel/qaic component related to bootlog initialization ordering. Specifically, resources required to process bootlog data from a device were being...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-986325)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986325 advisory. In the Linux kernel, the following vulnerability has been resolved: ASoC: rt5645: Fix errorenous cleanup order There is a logic error when removing rt5645 device as...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-986467)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986467 advisory. In the Linux kernel, the following vulnerability has been resolved: dm btree remove: fix use after free in rebalancechildren Move dmtmunlock after dmtmdec. Tenable h...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the orderField parameter in the REST API. An attacker can execute arbitrary HQL statements by injecting crafted input, potentially leading to unauthorized data access or manipulation. Remediation Upgrade...

SQL Injection

Overview org.xwiki.platform:xwiki-platform-oldcore is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of this package are vulnerable to SQL Injection via the orderField parameter in the REST API. An attacker can execute arbitrary HQL...

EUVD-2025-32540

XWiki Platform is vulnerable to HQL injection via wiki and space search REST API...

CVE-2025-52472

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0, the REST search URL is vulnerable to HQL injection via the orderField parameter. The specified value is...

CVE-2025-52472 XWiki Platform vulnerable to HQL injection via wiki and space search REST API

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0, the REST search URL is vulnerable to HQL injection via the orderField parameter. The specified value is...