CVE-2025-5372

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the sshkdf function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenl...

CVE-2025-4877

There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to sshgetfingerprinthash function. In such cases the bintobase64 function can experience an integer overflow leading to a memory under allocation, when that happens it's possibl...

CVE-2025-5449

A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash,...

CVE-2025-53021

A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the...

CVE-2025-5318

A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftphandle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in...

CVE-2025-6032

A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack...

CVE-2025-34034

A hardcoded credential vulnerability exists in the Blue Angel Software Suite deployed on embedded Linux systems. The application contains multiple known default and hardcoded user accounts that are not disclosed in public documentation. These accounts allow unauthenticated or low-privilege...

ROS-20250624-08

GIFLIB GIF library vulnerability is related to a boundary error in the function Dimplescreen2rgb in gif2rgb.c. Exploitation of the vulnerability could allow an attacker to execute arbitrary code on the target system...

libarchive security update

3.5.3-5 - Resolves: CVE-2025-25724...

CVE-2025-50182 vulnerabilities

Vulnerabilities for packages: py3-cassandra-medusa, kserve, dask-gateway, airflow, az, jwt-tool, k8s-sidecar, py3-pip, jupyter-base-notebook, dask-kubernetes, kubeflow-jupyter-web-app, ggshield, kubeflow-katib, reflex, emissary, superset, py3-pipenv, pypy-3.11, mlflow, kubeflow-pipelines,...

CVE-2025-50181 vulnerabilities

Vulnerabilities for packages: py3-cassandra-medusa, kserve, dask-gateway, airflow, az, jwt-tool, k8s-sidecar, py3-pip, jupyter-base-notebook, dask-kubernetes, kubeflow-jupyter-web-app, ggshield, kubeflow-katib, emissary, superset, py3-pipenv, pypy-3.11, datadog-agent, mlflow, kubeflow-pipelines,...

GHSA-48P4-8XCF-VXJ5 vulnerabilities

Vulnerabilities for packages: py3-cassandra-medusa, kserve, dask-gateway, airflow, az, jwt-tool, k8s-sidecar, py3-pip, jupyter-base-notebook, dask-kubernetes, kubeflow-jupyter-web-app, ggshield, kubeflow-katib, reflex, emissary, superset, py3-pipenv, pypy-3.11, mlflow, kubeflow-pipelines,...

GHSA-PQ67-6M6Q-MJ2V vulnerabilities

Vulnerabilities for packages: py3-cassandra-medusa, kserve, dask-gateway, airflow, az, jwt-tool, k8s-sidecar, py3-pip, jupyter-base-notebook, dask-kubernetes, kubeflow-jupyter-web-app, ggshield, kubeflow-katib, emissary, superset, py3-pipenv, pypy-3.11, datadog-agent, mlflow, kubeflow-pipelines,...

CVE-2025-6547

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: =3.1.2...

CVE-2025-6545

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js. This issue affects pbkdf2: from 3.0.10 through 3.1.2...

CVE-2025-6516

A vulnerability has been found in HDF5 up to 1.14.6 and classified as critical. This vulnerability affects the function H5Faddrdecodelen of the file /hdf5/src/H5Fint.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to...

CVE-2025-52968

xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie...

[SECURITY] Fedora 42 Update: mingw-python-setuptools-78.1.1-1.fc42

MinGW Windows Python setuptools library...

CVE-2025-52926

In scan.rs in spytrap-adb before 0.3.5, matches for known stalkerware are not rendered in the interactive user interface...

CVE-2025-6496

A vulnerability was found in HTACG tidy-html5 5.8.0. It has been declared as problematic. This vulnerability affects the function InsertNodeAsParent of the file src/parser.c. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been...