PT-2025-51656

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue within the NFS implementation. Specifically, when the TLS security policy is set to RPC XPRTSEC TLS X509, the nfs match client function does not proper...

CVE-2025-14038

EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints. This could allow an attacker to read potentially sensitive data or possibly cause a denial-of-service by writing malformed data to certain gRPC endpoints. This flaw has been...

CVE-2025-14038

EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints. This could allow an attacker to read potentially sensitive data or possibly cause a denial-of-service by writing malformed data to certain gRPC endpoints. This flaw has been...

CVE-2025-14038

EDB Hybrid Manager is affected by an unauthenticated-access flaw that allows direct access to certain gRPC endpoints due to a misconfiguration in the Istio Gateway, bypassing authentication and authorization. This can lead to potential data disclosure or denial-of-service by sending malformed dat...

EnterpriseDB Hybrid Manager - LTS 安全漏洞

EnterpriseDB Hybrid Manager - LTS is a hybrid cloud management software from EnterpriseDB, Inc. A security vulnerability exists in EnterpriseDB Hybrid Manager - LTS that originates from unauthorized access to a gRPC endpoint and could result in a data disclosure or denial of service...

PT-2025-51263

Name of the Vulnerable Software and Affected Versions EDB Hybrid Manager versions prior to 1.3.3 EDB Hybrid Manager - Innovation versions prior to 2025.12 EDB Hybrid Manager - LTS versions prior to 1.3.3 Description EDB Hybrid Manager has a flaw that allows an unauthenticated attacker to access...

GHSA-4JMP-X7MH-RGMR Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration

Summary The anti-slashing is not effective if the attacker can access EOTS manager endpoints. Impact If the EOTS manager endpoints are open to public without HMAC protection, the attacker can manually cause slashing of the finality provider through the RPC endpoints. Report credits go to:...

EUVD-2025-202927

SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 e.g., on Mini1prod2 allow administrative actions via unauthenticated LAN gRPC requests, aka MARMALADE 2. The cross-origin policy can be bypassed by omitting a Referer header. In some cases, an attacker's ability to read tilt, rotation,...

CVE-2025-67780

SpaceX Starlink Dish devices running firmware 2024.12.04.mr46620 are affected by CVE-2025-67780 due to unauthenticated LAN gRPC requests. The issue allows administrative actions via the diagnostic interface, and the cross-origin policy can be bypassed by omitting a Referer header, potentially ena...

SpaceX Starlink Dish 安全漏洞

SpaceX Starlink Dish is a user terminal receiver from SpaceX in the United States. A security vulnerability exists in SpaceX Starlink Dish version 2024.12.04.mr46620, which stems from an unauthenticated LAN gRPC request that could result in administrative operations...

PT-2025-50774

Name of the Vulnerable Software and Affected Versions SpaceX Starlink Dish versions 2024.12.04.mr46620 Description SpaceX Starlink Dish devices allow administrative actions via unauthenticated LAN gRPC requests, referred to as MARMALADE 2. The cross-origin policy can be bypassed by omitting a...

📄 Arista NGFW 17.3.1 Information Disclosure Scanner

This is a proof of concept testing script for an information disclosure vulnerability in Arista NGFW version 17.3.1. ============================================================================================================================================= | Title : Arista NGFW 17.3.1 Informati...

EUVD-2025-201858

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Disable periods-elapsed work when closing PCM avsdaifeshutdown handles the shutdown procedure for HOST HDAudio stream while period-elapsed work services its IRQs. As the former frees the DAI's private context,...

CVE-2025-40344 ASoC: Intel: avs: Disable periods-elapsed work when closing PCM

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Disable periods-elapsed work when closing PCM avsdaifeshutdown handles the shutdown procedure for HOST HDAudio stream while period-elapsed work services its IRQs. As the former frees the DAI's private context,...

The vulnerability of the `rpc_clnt_remove_pipedir()` function in the `net/sunrpc/clnt.c` module of the Linux operating system’s RPC protocol implementation allows a attacker to cause a service failure.

The vulnerability of the rpcclntremovepipedir function in the net/sunrpc/clnt.c module of the Linux kernel’s RPC implementation is related to the reallocation of memory after it has been freed. Exploiting this vulnerability could allow an attacker to cause a service failure...

rxrpc: Make it so that a waiting process can be aborted

...

The vulnerability of the rapidjson parser in the json2pb RPC framework of Apache bRPC allows a attacker to cause a service failure.

The vulnerability of the rapidjson library in the json2pb RPC framework of Apache bRPC is related to an uncontrolled recursion. Exploiting this vulnerability could allow a malicious actor to cause service failures...

RLSA-2025:16861 Moderate: mysql:8.0 security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. Security Fixes: mysql: mysqldump unspecified vulnerability CPU Apr 2025 CVE-2025-30722 mysql: Optimizer unspecified vulnerability CPU Apr 2025...

mysql:8.0 security update

An update is available for mecab-ipadic, mecab, module.mecab, module.mysql, mysql, module.mecab-ipadic. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list MySQL is ...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via resource exhaustion caused by improper cleanup of long-lived resources. Several components fail to correctly close or release gRPC connections, SPIFFE sources, and streaming...