dma-direct: Leak pages on dma_set_decrypted() failure

...

CVE-2025-59936 get-jwks poisoned JWKS cache allows post-fetch issuer validation bypass

get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. When the iss issuer claim is validated only after keys are retrieved from the cache, it is possible for cached keys from an...

CVE-2025-26278

A prototype pollution in the lib.set function of dref v0.1.2 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2024-46733: btrfs: fix qgroup reserve leaks in cowfilerange bsc1230708. CVE-2024-49996: cifs: Fix buffer overflow when parsing NFS reparse points bsc1232089...

SUSE-SU-2025:03382-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2024-46733: btrfs: fix qgroup reserve leaks in cowfilerange bsc1230708. - CVE-2024-49996: cifs: Fix buffer overflow when parsing NFS reparse points bsc1232089...

CVE-2025-55848

An issue was discovered in DIR-823 firmware 20250416. There is an RCE vulnerability in the setcassword settings interface, as the httpcasswd parameter is not filtered by '&'to allow injection of reverse connection commands...

CVE-2025-55848

An issue was discovered in DIR-823 firmware 20250416. There is an RCE vulnerability in the setcassword settings interface, as the httpcasswd parameter is not filtered by '&'to allow injection of reverse connection commands...

get-jwks: poisoned JWKS cache allows post-fetch issuer validation bypass

Summary A vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. Details When the iss issuer claim is validated only after keys are retrieved from the cache, it is possible for cached keys from an unexpected issuer to be reused, resulting in a bypass of issuer...

CLSA-2025-1758896397 php: Fix of CVE-2017-9228

CVE-2017-9228: fix heap out-of-bounds write in bitsetsetrange and parsecharclass functions...

CLSA-2025-1758892974 php: Fix of CVE-2017-9228

CVE-2017-9228: fix heap out-of-bounds write in bitsetsetrange and parsecharclass functions...

GHSA-62MQ-GRC2-53J3 Duplicate Advisory: Open Babel has NULL pointer dereference in CACAO CacaoFormat::SetHilderbrandt

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-55j6-rjhx-hwfh. This link is maintained to preserve external references. Original Description A vulnerability was found in Open Babel up to 3.1.1. The impacted element is the function CacaoFormat::SetHilderbrand...

Duplicate Advisory: Open Babel has NULL pointer dereference in CACAO CacaoFormat::SetHilderbrandt

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-55j6-rjhx-hwfh. This link is maintained to preserve external references. Original Description A vulnerability was found in Open Babel up to 3.1.1. The impacted element is the function CacaoFormat::SetHilderbrand...

CVE-2025-10999 Open Babel cacaoformat.cpp SetHilderbrandt null pointer dereference

A vulnerability was found in Open Babel up to 3.1.1. The impacted element is the function CacaoFormat::SetHilderbrandt of the file /src/formats/cacaoformat.cpp. The manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been made public an...

[SECURITY] Fedora 41 Update: python-orderly-set-5.5.0-2.fc41

Orderly Set is a package containing multiple implementations of Ordered Set...

[SECURITY] Fedora 42 Update: python-orderly-set-5.5.0-2.fc42

Orderly Set is a package containing multiple implementations of Ordered Set...

Django annotate alias Code Execution

The vulnerability of the LoginView, LogoutView, and setlanguage functions in the Django web application framework is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

Fedora 42 : python-deepdiff / python-orderly-set (2025-6ecd8d4f9b)

The remote Fedora 42 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-6ecd8d4f9b advisory. Update to 8.6.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Fedora 41 : python-deepdiff / python-orderly-set (2025-ca5f759234)

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-ca5f759234 advisory. Update to 8.6.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

CVE-2025-55848

An issue was discovered in DIR-823 firmware 20250416. There is an RCE vulnerability in the setcassword settings interface, as the httpcasswd parameter is not filtered by '&'to allow injection of reverse connection commands...

CVE-2025-55848

The D-Link DIR-823X wireless router contains a Remote Code Execution (RCE) vulnerability in its set_cassword() settings interface. The root cause is the lack of proper input validation or cleaning for the http_casswd parameter, which fails to filter special characters like & . This allows an atta...