CVE-2025-59419

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Netty contains an SMTP command injection vulnerability due to insufficient input validation for Carriage Return \r and Line Feed \n characters in user-suppli...

CVE-2025-39997

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix race condition to UAF in sndusbmidifree The previous commit 0718a78f6a9f "ALSA: usb-audio: Kill timer properly at removal" patched a UAF issue caused by the error timer. However, because the error timer kill...

CVE-2025-55315

A flaw was found in ASP.NET Core’s HTTP request handling that leads to inconsistent interpretation of specially crafted HTTP requests. This mismatch can be abused by an authorized network attacker to smuggle or manipulate request boundaries, allowing bypass of security controls or unintended...

CVE-2025-11715

Memory safety bugs present in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox...

CVE-2025-11731

A flaw was found in the exsltFuncResultComp function of libxslt, which handles EXSLT elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads...

Linux Distros Unpatched Vulnerability : CVE-2022-3965

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function smcencodestream of the file libavcodec/smcenc.c of the...

CVE-2025-7707

The llamaindex library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, leading to potential denial of service, dat...

CVE-2025-25017

A Cross-Site Scripting XSS vulnerability in Kibana’s Vega visualization engine. It results from improper input validation in Vega visualization specifications, allowing attackers to inject malicious JavaScript. Successful exploitation could lead to session hijacking, data theft, or privilege...

Linux Distros Unpatched Vulnerability : CVE-2023-53620

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - md: fix soft lockup in statusresync statusresync will calculate 'currresync - recoveryactive' to show user a progress bar like following: ============...

Linux Distros Unpatched Vulnerability : CVE-2023-53649

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: perf trace: Really free the evsel-priv area In 3cb4d5e00e037c70 perf trace: Free syscall tp...

Linux Distros Unpatched Vulnerability : CVE-2023-53630

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix unpinning of pages when an access is present syzkaller found that the calculati...

Linux Distros Unpatched Vulnerability : CVE-2022-50530

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix null pointer dereference in blkmqclearrqmapping Our syzkaller report a null...

Linux Distros Unpatched Vulnerability : CVE-2023-53635

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: conntrack: fix wrong ct-timeout value struct nfconn-timeout is an interval before the conntrack confirmed. After confirmed, it becomes a timestamp. I...

CVE-2025-11579

github.com/nwaples/rardecode versions =2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Crash. Mitigation Mitigation for this issue is either not...

CVE-2025-39962

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix untrusted unsigned subtract Fix the following Smatch static checker warning: net/rxrpc/rxgkapp.c:65 rxgkyfsdecodeticket warn: untrusted unsigned subtract. 'ticketlen - 10 4' by prechecking the length of what we're tryi...

Linux Distros Unpatched Vulnerability : CVE-2022-50512

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ext4: fix potential memory leak in ext4fcrecordregions As krealloc may return NULL, in this case 'state-fcregions' may not be freed by krealloc, but...

Linux Distros Unpatched Vulnerability : CVE-2022-50500

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netdevsim: fix memory leak in nsimdrvprobe when nsimdevresourcesregister failed If some items in nsimdevresourcesregister fail, memory leak will occur. The...

Linux Distros Unpatched Vulnerability : CVE-2023-53518

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PM / devfreq: Fix leak in devfreqdevrelease srcuinitnotifierhead allocates resources that need to be released with a srcucleanupnotifierhead call. Reported by...

Linux Distros Unpatched Vulnerability : CVE-2022-50427

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: ac97: fix possible memory leak in sndac97devregister If deviceregister fails in sndac97devregister, it should call putdevice to give up reference, or the...

Linux Distros Unpatched Vulnerability : CVE-2023-53484

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lib: cpurmap: Avoid use after free on rmap-obj array entries When calling irqsetaffinitynotifier with NULL at the notify argument, it will cause freeing of the...