python-setuptools security update

0.9.8-7.0.3 - Fix CVE-2025-47273 Orabug: 38247921...

GHSA-Q6GG-9F92-R9WG vulnerabilities

Vulnerabilities for packages: traefik, traefik-fips...

CVE-2025-54386 vulnerabilities

Vulnerabilities for packages: traefik, traefik-fips...

CVE-2025-50422

Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled-face == NULL" assertion failure for cairoftunscaledfontfini in cairo-ft-font.c...

CVE-2025-54351

In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used for MSGTRUNC in recv...

CVE-2023-32253

A flaw was found in the Linux kernel's ksmbd component. A deadlock is triggered by sending multiple concurrent session setup requests, possibly leading to a denial of service...

CVE-2025-23279

NVIDIA .run Installer for Linux and Solaris contains a vulnerability where an attacker could use a race condition to escalate privileges. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, denial of service, or data tampering...

CVE-2023-32256

A flaw was found in the Linux kernel's ksmbd component. A race condition between smb2 close operation and logoff in multichannel connections could result in a use-after-free issue...

GHSA-WPRM-FGRX-XJ42 vulnerabilities

Vulnerabilities for packages: agentbeat, nvidia-nsight-compute-12.9, nvidia-nsight-compute-13.2, kubeflow-katib, nvidia-nsight-compute-13.0, nvidia-nsight-compute-12.8, nvidia-nsight-compute-13.1, newrelic-fluent-bit-output, nemo...

CVE-2025-45767

jose v6.0.10 was discovered to contain weak encryption. NOTE: this is disputed by a third party because the claim of "do not meet recommended security standards" does not reflect guidance in a final publication...

CVE-2025-48071

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.2 through 3.3.0, there is a heap-based buffer overflow during a write operation when decompressing ZIPS-packed deep scan-line EXR files...

CVE-2023-32251

A vulnerability has been identified in the Linux kernel's ksmbd component kernel SMB/CIFS server. A security control designed to prevent dictionary attacks, which introduces a 5-second delay during session setup, can be bypassed through the use of asynchronous requests. This bypass negates the...

CVE-2025-45770

jwt v5.4.3 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant ...

GHSA-6V2P-P543-PHR9 vulnerabilities

Vulnerabilities for packages: argo-events, certificate-transparency, grafana-operator, kubevela, kubernetes, apko, temporal-ui-server, kubeflow-pipelines, velero-plugin-for-microsoft-azure, multus-cni, grafana-agent-operator, cosign, xeol, crossplane-provider-aws-sqs, dex, scorecard, helm-operato...

GHSA-XFFM-G5W8-QVG7 vulnerabilities

Vulnerabilities for packages: grafana-image-renderer...

GHSA-XFFM-G5W8-QVG7 vulnerabilities

Vulnerabilities for packages: grafana-image-renderer...

CVE-2025-45770

jwt v5.4.3 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant ...

CVE-2025-53357

GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 0.78 through 10.0.18, a connected user can alter the reservations of another user. Thi...

CVE-2025-53112

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.1.0 through 10.0.18, a lack of permission checks can result in unauthorized removal of some specific resources. This is fixed in version 10.0.1...

CVE-2025-53111

GLPI is a Free Asset and IT Management Software package. In versions 0.80 through 10.0.18, a lack of permission checks can result in unauthorized access to some resources. This is fixed in version 10.0.19...