SUSE CVE-2025-59431

MapServer is a system for developing web-based GIS applications. Prior to 8.4.1, the XML Filter Query directive PropertyName is vulnerably to Boolean-based SQL injection. It seems like expression checking is bypassed by introducing double quote characters in the PropertyName. Allowing to manipula...

CVE-2025-59434

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to August 2025 Cloud-Hosted Flowise, an authenticated vulnerability in Flowise Cloud allows any user on the free tier to access sensitive environment variables from other tenants via the Custom JavaScri...

CVE-2025-58269

CVE-2025-58269 affects WP Project Manager (weDevs). The vulnerability is described as a hard-coded credentials issue that could allow retrieval of embedded sensitive data from WP Project Manager versions up to 2.6.25. The connected data indicates no published exploit details in the provided docs,...

Fedora 44 : nextcloud (2025-b4b3303299)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-b4b3303299 advisory. Automatic update for nextcloud-31.0.9-1.fc44. Changelog Sat Sep 20 2025 Andrew Bauer - 31.0.9-1 - 31.0.9 release RHBZ2388493 RHBZ2389830 RHBZ2389831...

CVE-2025-34198

creationtimestamp| type| source ---|---|--- 2025-09-20 04:32:24+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lzakdd6ei62d...

CVE-2025-39861

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: vhci: Prevent use-after-free by removing debugfs files early Move the creation of debugfs files into a dedicated function, and ensure they are explicitly removed during vhcirelease, before associated data structures ar...

CVE-2025-39853

In the Linux kernel, the following vulnerability has been resolved: i40e: Fix potential invalid access when MAC list is empty listfirstentry never returns NULL - if the list is empty, it still returns a pointer to an invalid object, leading to potential invalid memory access when dereferenced. Fi...

Threat landscape for industrial automation systems in Q2 2025

Statistics across all threats In Q2 2025, the percentage of ICS computers on which malicious objects were blocked decreased by 1.4 pp from the previous quarter to 20.5%. Percentage of ICS computers on which malicious objects were blocked, Q2 2022–Q2 2025 Compared to Q2 2024, the rate decreased by...

BIT-MONGODB-2025-10060 MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation

MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork state management. This issue affects MongoDB Server v6.0...

CVE-2025-10668

creationtimestamp| type| source ---|---|--- 2025-09-18 16:30:40+00:00| seen| https://gist.github.com/Darkcrai86/1bf52d7261abd6e01fbcf1769800bdf1...

CVE-2023-53428

In the Linux kernel, the following vulnerability has been resolved: powercap: armscmi: Remove recursion while parsing zones Powercap zones can be defined as arranged in a hierarchy of trees and when registering a zone with powercapregisterzone, the kernel powercap subsystem expects this to happen...

CVE-2022-50383

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Can't set dst buffer to done when lat decode error Core thread will call v4l2m2mbufdone to set dst buffer done for lat architecture. If lat call v4l2m2mbufdoneandjobfinish to free dst buffer when lat deco...

CVE-2023-53379

In the Linux kernel, the following vulnerability has been resolved: usb: phy: phy-tahvo: fix memory leak in tahvousbprobe Smatch reports: drivers/usb/phy/phy-tahvo.c: tahvousbprobe warn: missing unwind goto? After geting irq, if ret 0, it will return without error handling to free memory. Just ad...

CVE-2025-10585

creationtimestamp| type| source ---|---|--- 2025-09-17 23:21:47+00:00| seen| https://bsky.app/profile/secureblue.dev/post/3lz2y23vazc2f 2025-09-18 03:00:11+00:00| seen| https://bsky.app/profile/crowdcyber.bsky.social/post/3lz3eamyenc2c 2025-09-18 03:49:00+00:00| seen|...

CVE-2025-34187

creationtimestamp| type| source ---|---|--- 2025-09-16 20:09:48+00:00| seen| https://gist.github.com/Darkcrai86/ce4b6ea5fab89aafce7454fb6fb57945 2025-09-17 00:02:04+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lyyjt6twzf2b 2025-09-17 21:02:30+00:00| seen|...

CVE-2022-50339

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: avoid hcidevtestandsetflag in mgmtinithdev syzbot is again reporting attempt to cancel uninitialized work at mgmtindexremoved 1, for setting of HCIMGMT flag from mgmtinithdev from hcimgmtcmd from hcisocksendmsg can rac...

CVE-2022-50351

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix xid leak in cifscreate If the cifs already shutdown, we should free the xid before return, otherwise, the xid will be leaked...

CVE-2025-39832

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix lockdep assertion on sync reset unload event Fix lockdep assertion triggered during sync reset unload event. When the sync reset flow is initiated using the devlink reload fwactivate option, the PF already holds the...

CVE-2025-39809

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length The QuickI2C ACPI DSD methods return ICRS and ISUB data with a trailing byte, making the actual length is one more byte than the structs defined. It caused...

CVE-2025-39832

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix lockdep assertion on sync reset unload event Fix lockdep assertion triggered during sync reset unload event. When the sync reset flow is initiated using the devlink reload fwactivate option, the PF already holds the...