MGASA-2025-0118 Updated chromium-browser-stable packages fix security vulnerability

Use after free in Lens. CVE-2025-2476...

CVE-2025-31181

A flaw was found in gnuplot. The X11graphics function may lead to a segmentation fault and cause a system crash...

CVE-2025-21885 RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Fix the page details for the srq created by kernel consumers While using nvme target with usesrq on, below kernel panic is noticed. 549.698111 bnxten 0000:41:00.0 enp65s0np0: FEC autoneg off encoding: Clause 91...

CVE-2025-21874 dm-integrity: Avoid divide by zero in table status in Inline mode

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: Avoid divide by zero in table status in Inline mode In Inline mode, the journal is unused, and journalsectors is zero. Calculating the journal watermark requires dividing by journalsectors, which should be done only...

CVE-2025-25086

Cross-Site Request Forgery CSRF vulnerability in WPDeveloper Secret Meta facebook-secret-meta allows Reflected XSS.This issue affects Secret Meta: from n/a through = 1.2.1...

CVE-2025-0811 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Improper rendering of certain file types leads to cross-site scripting...

CVE-2025-30847

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ashley Novelist novelist allows Stored XSS.This issue affects Novelist: from n/a through = 1.2.3...

Denial Of Service (DoS)

ai.h2o, h2o-ext-xgboost is vulnerable to Denial Of Service DoS . The vulnerability is due to improper exposure of internal classes through the ast parser in the runtool command, allows attackers to exploit the XGBoostLibExtractTool class to perform arbitrary file writes and shut down the server...

CVE-2025-25374

In NASA cFS Core Flight System Aquila, it is possible to put the onboard software in a state that will prevent the launch of any external application, causing a platform denial of service...

PT-2025-24376 · Microhard · Microhard Bulletlte-Na2 +1

Name of the Vulnerable Software and Affected Versions: Microhard BulletLTE-NA2 and IPn4Gii-NA2 affected versions not specified Description: The issue is a post-authentication command injection problem in the AT+MFIP command, which can lead to privilege escalation. This is an instance of improper...

CVE-2025-29487

An out-of-memory error in the parseABCSTRINGINFO function of libming v0.4.8 allows attackers to cause a Denial of Service DoS due to allocator exhaustion...

CVE-2025-29497

libming v0.4.8 was discovered to contain a memory leak via the parseSWFMORPHFILLSTYLES function...

CVE-2024-55070

A Broken Object Level Authorization vulnerability in the component /households/permissions of hay-kot mealie v2.2.0 allows group managers to edit their own permissions...

CVE-2025-29492

libming v0.4.8 was discovered to contain a segmentation fault via the decompileSETVARIABLE function...

PT-2025-13417 · Dell · Dell Unity

Name of the Vulnerable Software and Affected Versions: Dell Unity versions 5.4 and prior Description: The issue is related to an Improper Neutralization of Special Elements used in an OS Command, also known as 'OS Command Injection'. This could allow a low-privileged attacker with local access to...

PT-2025-13423 · Dell · Dell Unity

Name of the Vulnerable Software and Affected Versions: Dell Unity versions 5.4 and prior Description: The issue is related to an Improper Neutralization of Special Elements used in an OS Command, also known as 'OS Command Injection'. This could allow a low-privileged attacker with local access to...

PT-2025-13385 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.8 Description: A SQL Injection issue was identified in the "/WeGIA/html/socio/sistema/controller/query geracao auto.php" endpoint, specifically in the query parameter. This issue allows the execution of arbitrary S...

PT-2025-13426 · Dell · Dell Unity

Name of the Vulnerable Software and Affected Versions: Dell Unity versions 5.4 and prior Description: The issue is related to an Improper Neutralization of Special Elements used in an OS Command, also known as 'OS Command Injection'. This could allow a low-privileged attacker with local access to...

PT-2025-13383 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.6 Description: A stored Cross-Site Scripting XSS issue was identified, allowing unauthorized scripts to be executed within the user's browser context. This type of XSS is particularly critical because the malicious...

PT-2025-13028 · Unknown · Mingyuefusu 图书管理系统

Name of the Vulnerable Software and Affected Versions: mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 Description: A problem was found in the software, classified as problematic, affecting some unknown processing. The manipulation leads to cross-site...