CLSA-2025-1754554806 libxml2: Fix of CVE-2025-7425

CVE-2025-7425: fix heap-use-after-free in xmlFreeID caused by atype corruption...

CLSA-2025-1754552473 libxml2: Fix of CVE-2025-7425

CVE-2025-7425: fix heap-use-after-free in xmlFreeID caused by atype corruption...

crypto: algif_hash - fix double free in hash_accept

...

fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var

...

atm: Revert atm_account_tx() if copy_from_iter_full() fails.

...

ksmbd: fix null pointer dereference in destroy_previous_session

...

Security Bulletin: Vulnerabilities in Babel affects IBM watsonx Orchestrate with watsonx Assistant Cartridge

Summary Potential vulnerability in Babel has been identified that affects IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component. The vulnerability has been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2025-27789 DESCRIPTION: Babel is a...

CVE-2025-54882

CVE-2025-54882 affects Himmelblau, an interoperability suite for Microsoft Azure Entra ID and Intune. From the public records, versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0 store the cloud TGT during logon in the Kerberos credential cache, and the created credential cache collection ...

CVE-2025-54882 Himmelblau's Kerberos credential cache collection is world readable

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himmelblau stores the cloud TGT received during logon in the Kerberos credential cache. The created credential cache collection and received credentials...

Linux Distros Unpatched Vulnerability : CVE-2025-21941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/display: Fix null check for pipectx-planestate in resourcebuildscalingparams Null pointer dereference issue could occur when pipectx-planestate is null...

CVE-2025-51533

An Insecure Direct Object Reference IDOR in Sage DPW v202412004 and below allows unauthorized attackers to access internal forms via sending a crafted GET request...

quiche -- Infinite loop triggered by connection ID retirement

Quiche Releases reports: This update includes 1 security fix: High CVE-2025-7054: Infinite loop triggered by connection ID retirement. Reported by Catena cyber on 2025-08-07...

Moderate: libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: The libxml2 library is a development toolbox providing the implementation of...

CVE-2025-48394

An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI. This security issue has been fixed in the latest version which is available on the Eaton download center...

GHSA-7RX2-769V-HRWF HashiCorp Vault ldap auth method may not have correctly enforced MFA

Vault and Vault Enterprise’s “Vault” ldap auth method may not have correctly enforced MFA if usernameasalias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and...

btrfs: avoid NULL pointer dereference if no valid csum tree

...

RHEL 9 : python-cryptography (RHSA-2025:13102)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:13102 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

CVE-2025-51531

A reflected cross-site scripting XSS vulnerability in Sage DPW 202412004 and earlier allows attackers to execute arbitrary JavaScript in the context of a victim's browser via injecting a crafted payload into the tabfields parameter at /dpw/scripts/cgiip.exe/WService. The vendor has stated that th...

RHEL 9 : kernel (RHSA-2025:13135)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:13135 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: powerpc: Fix access beyond en...

CVE-2025-54125 XWiki Platform: Password and email exposure in xml.vm fields

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 1.1 through 16.4.6, 16.5.0-rc-1 through 16.10.4 and 17.0.0-rc-1 through 17.1.0, the XML export of a page in XWiki that can b...