CVE-2025-60018 Glib-networking: out of bound reads on glib-networking through tls/openssl/gtlscertificate-openssl.c via "g_tls_certificate_openssl_get_property()"

glib-networking's OpenSSL backend fails to properly check the return value of a call to BIOwrite, resulting in an out of bounds read...

CVE-2025-6544

CVE-2025-6544 affects h2oai/h2o-3 up to version 3.46.0.8. The issue is a deserialization vulnerability that enables an attacker to read arbitrary system files and execute arbitrary code. Root cause: improper handling of JDBC connection parameters, exploitable via bypassing regular expression chec...

WordPress StoreEngine plugin path traversal vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A path traversal vulnerability exists in the WordPress StoreEngine plugin, which stems from a path traversal issue in the filedownload function. An attacker can exploit this...

CVE-2023-53383 irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4

In the Linux kernel, the following vulnerability has been resolved: irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4 The T241 platform suffers from the T241-FABRIC-4 erratum which causes unexpected behavior in the GIC when multiple transactions are received simultaneously from different...

PT-2025-38441

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The Linux kernel contains an issue where a memory leak occurs when reading the fw info file completely, as the status tracking object is not freed after returning NULL, indicating no...

dnsdist -- Denial of service via crafted DoH exchange

[email protected] reports: In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an...

PT-2025-38305

Name of the Vulnerable Software and Affected Versions DNSdist affected versions not specified Description DNSdist, when configured to utilize the nghttp2 library for processing DNS over HTTPS DoH queries, may be susceptible to a denial of service. A crafted DoH exchange can trigger an unbounded I...

SUSE CVE-2023-53360

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: Rework scratch handling for READPLUS again I found that the read code might send multiple requests using the same nfspgioheader, but nfs4procreadsetup is only called once. This is how we ended up occasionally...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the gRPC API and HTTP APIs, which allow peers to send requests that cause the recipient to create files in arbitrary file system locations and read arbitrary files. An attacker can access sensitive data or execu...

CVE-2025-59352

Dragonfly CVE-2025-59352 affects the Dragonfly open source P2P file distribution and image acceleration system. Prior to version 2.1.0, the gRPC API and HTTP APIs allow peers to request actions that force the recipient to create files in arbitrary filesystem locations and to read arbitrary files,...

DEBIAN-CVE-2023-53360

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: Rework scratch handling for READPLUS again I found that the read code might send multiple requests using the same nfspgioheader, but nfs4procreadsetup is only called once. This is how we ended up occasionally...

CVE-2023-53360 NFSv4.2: Rework scratch handling for READ_PLUS (again)

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: Rework scratch handling for READPLUS again I found that the read code might send multiple requests using the same nfspgioheader, but nfs4procreadsetup is only called once. This is how we ended up occasionally...

CVE-2023-53360

CVE-2023-53360: Technical details are not publicly provided in the supplied documents. No explicit affected products/versions, impact, or remediation are stated here. Monitor official advisories for concrete details and fixes.

CVE-2023-53360

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: Rework scratch handling for READPLUS again I found that the read code might send multiple requests using the same nfspgioheader, but nfs4procreadsetup is only called once. This is how we ended up occasionally...

CVE-2023-53360 NFSv4.2: Rework scratch handling for READ_PLUS (again)

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: Rework scratch handling for READPLUS again I found that the read code might send multiple requests using the same nfspgioheader, but nfs4procreadsetup is only called once. This is how we ended up occasionally...

WordPress plugin StoreEngine 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A path traversal vulnerability exists in the WordPress StoreEngine plugin, which stems from a path traversal issue in the filedownload function. An attacker can exploit this...

CVE-2025-39813 ftrace: Fix potential warning in trace_printk_seq during ftrace_dump

In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix potential warning in traceprintkseq during ftracedump When calling ftracedumpone concurrently with reading tracepipe, a WARNONONCE in traceprintkseq can be triggered due to a race condition. The issue occurs because:...

PT-2025-37519

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The Linux kernel contains a data-race condition within the kcm Kernel Connection Multiplexor subsystem. Specifically, kcm-rx psock can be read without a lock in the kcm rfree function,...

CVE-2025-58761

CVE-2025-58761 affects Tautulli before 2.16.0. The vulnerable endpoint is real_pms_image_proxy, which allows unauthenticated path traversal to read arbitrary files on the server (e.g., tautulli.db with active JWT tokens and config.ini with admin password hash and secrets). Validation on the img p...

CVE-2025-54249

Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate server-side requests and bypass security controls...