GHSA-5JPX-9HW9-2FX4 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu...

CVE-2025-37727 vulnerabilities

Vulnerabilities for packages: ruby3.2-elasticsearch, conductor, ruby3.3-elasticsearch, conductor-fips, elasticsearch-fips, ruby3.4-elasticsearch...

GHSA-56R7-H6MW-RCFV vulnerabilities

Vulnerabilities for packages: ruby3.2-elasticsearch, conductor, ruby3.3-elasticsearch, conductor-fips, elasticsearch-fips, ruby3.4-elasticsearch...

xorg: xmayland: Use-after-free in XPresentNotify structure creation

A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can leave dangling pointers that lead to a use-after-free condition. This can cause memory corruption or a crash, potentially allowing an...

[SECURITY] Fedora 42 Update: rust-manyhow-macros-0.11.4-1.fc42

Macro for manyhow...

[SECURITY] Fedora 41 Update: rust-reqsign-http-send-reqwest-2.0.0-1.fc41

Reqwest-based HTTP client implementation for reqsign...

[SECURITY] Fedora 41 Update: rust-manyhow-0.11.4-1.fc41

Proc macro error handling =C3=A0 la anyhow x proc-macro-error...

Astra Linux – Vulnerability in Firefox and Thunderbird

The JavaScript engine did not handle closed generators correctly, and it was possible to resume them, leading to a nullptr dereference. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140....

Astra Linux - уязвимость в vim

Use After Free in GitHub repository vim/vim prior to 8.2...

GHSA-JV6H-4262-Q663 vulnerabilities

Vulnerabilities for packages: guacamole-client, logstash-fips, opensearch...

SUSE CVE-2025-12440

Inappropriate implementation in Autofill in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Low...

CVE-2025-36137 IBM Sterling Connect:Direct for UNIX command execution

IBM Sterling Connect Direct for Unix 6.2.0.7 through 6.2.0.9 iFix004, 6.4.0.0 through 6.4.0.2 iFix001, and 6.3.0.2 through 6.3.0.5 iFix002 incorrectly assigns permissions for maintenance tasks to Control Center Director CCD users that could allow a privileged user to escalate their privileges...

CVE-2025-12060

The keras.utils.getfile API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can craft a malicious tar archive containing special...

CVE-2025-12060

The keras.utils.getfile API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can craft a malicious tar archive containing special...

CVE-2025-40102

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Prevent access to vCPU events before init Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpreting a bunch of...

[SECURITY] Fedora 42 Update: qt6-qtquick3d-6.9.3-1.fc42

The Qt 6 Quick3D library...

[SECURITY] Fedora 42 Update: qt6-qtmqtt-6.9.3-1.fc42

MQTT is a machine-to-machine M2M protocol utilizing the publish-and-subscri be paradigm, and provides a channel with minimal communication overhead. The Qt MQTT module provides a standard compliant implementation of the MQTT protocol specification. It enables applications to act as telemetry...

CVE-2025-58183

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a...

CVE-2025-12058

The Keras.Model.loadmodel method, including when executed with the intended security mitigation safemode=True, is vulnerable to arbitrary local file loading and Server-Side Request Forgery SSRF. This vulnerability stems from the way the StringLookup layer is handled during model loading from a...

ROS-20251029-01

Gstreamer multimedia framework vulnerability is related to a buffer overflow on the stack. Exploitation exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...