SUSE CVE-2025-12440

Inappropriate implementation in Autofill in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Low...

CVE-2025-36137 IBM Sterling Connect:Direct for UNIX command execution

IBM Sterling Connect Direct for Unix 6.2.0.7 through 6.2.0.9 iFix004, 6.4.0.0 through 6.4.0.2 iFix001, and 6.3.0.2 through 6.3.0.5 iFix002 incorrectly assigns permissions for maintenance tasks to Control Center Director CCD users that could allow a privileged user to escalate their privileges...

CVE-2025-12060

The keras.utils.getfile API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can craft a malicious tar archive containing special...

CVE-2025-12060

Removed by vendor...

[SECURITY] Fedora 42 Update: qt6-qtquick3d-6.9.3-1.fc42

The Qt 6 Quick3D library...

[SECURITY] Fedora 42 Update: qt6-qtmqtt-6.9.3-1.fc42

MQTT is a machine-to-machine M2M protocol utilizing the publish-and-subscri be paradigm, and provides a channel with minimal communication overhead. The Qt MQTT module provides a standard compliant implementation of the MQTT protocol specification. It enables applications to act as telemetry...

CVE-2025-40102

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Prevent access to vCPU events before init Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpreting a bunch of...

CVE-2025-58183

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a...

CVE-2025-12058

The Keras.Model.loadmodel method, including when executed with the intended security mitigation safemode=True, is vulnerable to arbitrary local file loading and Server-Side Request Forgery SSRF. This vulnerability stems from the way the StringLookup layer is handled during model loading from a...

ROS-20251029-01

Gstreamer multimedia framework vulnerability is related to a buffer overflow on the stack. Exploitation exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...

CVE-2025-11375

Consul and Consul Enterprise’s “Consul” event endpoint is vulnerable to denial of service DoS due to lack of maximum value on the Content Length header. This vulnerability, CVE-2025-11375, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12...

CVE-2024-45777 affecting package grub2 for versions less than 2.06-25

CVE-2024-45777 affecting package grub2 for versions less than 2.06-25. A patched version of the package is available...

CVE-2025-58749 affecting package fluent-bit for versions less than 3.1.9-6

CVE-2025-58749 affecting package fluent-bit for versions less than 3.1.9-6. A patched version of the package is available...

CVE-2020-28851 affecting package buildah for versions less than 1.41.4-2

CVE-2020-28851 affecting package buildah for versions less than 1.41.4-2. An upgraded version of the package is available that resolves this issue...

CVE-2022-32149 affecting package podman for versions less than 5.6.1-2

CVE-2022-32149 affecting package podman for versions less than 5.6.1-2. An upgraded version of the package is available that resolves this issue...

CVE-2024-45310 affecting package buildah for versions less than 1.41.4-2

CVE-2024-45310 affecting package buildah for versions less than 1.41.4-2. An upgraded version of the package is available that resolves this issue...

CVE-2025-58058 affecting package packer for versions less than 1.9.5-10

CVE-2025-58058 affecting package packer for versions less than 1.9.5-10. A patched version of the package is available...

CVE-2021-38561 affecting package podman for versions less than 5.6.1-2

CVE-2021-38561 affecting package podman for versions less than 5.6.1-2. An upgraded version of the package is available that resolves this issue...

GHSA-64W3-5Q9M-68XF vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2025-40070

In the Linux kernel, the following vulnerability has been resolved: pps: fix warning in ppsregistercdev when register device fail Similar to previous commit 2a934fdb01db "media: v4l2-dev: fix error handling in videoregisterdevice", the release hook should be set before deviceregister. Otherwise,...