10213 matches found
CVE-2025-38694
In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090prwonapb In dib7090prwonapb, msg is controlled by user. When msg0.buf is null and msg0.len is zero, former checks on msg0.buf would be passed. If accessing msg0.buf2...
CVE-2025-38686
In the Linux kernel, the following vulnerability has been resolved: userfaultfd: fix a crash in UFFDIOMOVE when PMD is a migration entry When UFFDIOMOVE encounters a migration PMD entry, it proceeds with obtaining a folio and accessing it even though the entry is swpentryt. Add the missing check...
CVE-2025-38682
In the Linux kernel, the following vulnerability has been resolved: i2c: core: Fix double-free of fwnode in i2cunregisterdevice Before commit df6d7277e552 "i2c: core: Do not dereference fwnode in struct device", i2cunregisterdevice only called fwnodehandleput on ofnode-s in the form of calling...
CVE-2025-38720
In the Linux kernel, the following vulnerability has been resolved: net: hibmcge: fix rtnl deadlock issue Currently, the hibmcge netdev acquires the rtnllock in pcierrorhandlers.resetprepare and releases it in pcierrorhandlers.resetdone. However, in the PCI framework: pciresetbus - pciresetslot -...
CVE-2025-38718
In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso packets in sctprcv A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported two use-of-uninitialized-memory bugs...
CVE-2025-38703
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Make dma-fences compliant with the safe access rules Xe can free some of the data pointed to by the dma-fences it exports. Most notably the timeline name can get freed if userspace closes the associated submit queue. At t...
CVE-2025-38687
In the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi in the below link, which is due to comedi gladly removing the allocated async area even though poll requests are still active on the...
CVE-2025-9901
A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be...
CVE-2025-9817
SSH dissector crash in Wireshark 4.4.0 to 4.4.8 allows denial of service...
GHSA-4342-X723-CH2F vulnerabilities
Vulnerabilities for packages: jitsucom-jitsu...
CVE-2025-9732
A vulnerability was identified in DCMTK up to 3.6.9. This affects an unknown function in the library dcmimage/include/dcmtk/dcmimage/diybrpxt.h of the component dcm2img. Such manipulation leads to memory corruption. Local access is required to approach this attack. The name of the patch is...
GHSA-XH9H-692F-MMG4 vulnerabilities
Vulnerabilities for packages: py3-knack, az...
CVE-2025-57804 vulnerabilities
Vulnerabilities for packages: airflow...
CVE-2025-58068
Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted...
CVE-2025-9478 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-Q376-JH5M-V6WP vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2025-47909
Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to https://example.com because the Origin...
CVE-2025-40927
CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions. Although some...