kernel: e1000e: fix heap overflow in e1000_set_eeprom

A heap‑overflow vulnerability was discovered in the linux kernel e1000e driver’s e1000seteeprom function, insufficient validation of the requested length for an EEPROM change could allow a local, low‑privilege user to trigger memory corruption heap overflow. A local unprivileged user with access ...

CVE-2025-8045

CVE-2025-8045 is a local, use-after-free vulnerability affecting Arm Valhall GPU Kernel Driver and Arm 5th Gen GPU Architecture Kernel Driver. The issue allows a local non-privileged process to cause improper GPU processing and gain access to previously freed memory. Affected ranges: Valhall GPU ...

CVE-2025-2879

CVE-2025-2879 affects Arm Valhall GPU Kernel Driver and Arm 5th Gen GPU Architecture Kernel Driver. A local, non-privileged user could perform improper GPU processing operations to expose sensitive data. Affected versions: Valhall: r29p0–r49p4 and r50p0–r54p0; Arm 5th Gen: r41p0–r49p4 and r50p0–r...

ASB-A-326926596

In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

ASB-A-305710469

In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2025-48443

Name of the Vulnerable Software and Affected Versions Zabbix Agent versions affected versions not specified Description The Zabbix Agent builds on AIX are susceptible to a library loading hijacking issue. Local users possessing write access to the /home/cecuser directory can exploit this to hijac...

PT-2025-48437

Name of the Vulnerable Software and Affected Versions Arm Ltd Valhall GPU Kernel Driver versions r53p0 through r54p1 Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver versions r53p0 through r54p1 Description A Use After Free issue exists in the Arm Ltd Valhall GPU Kernel Driver and Arm Ltd Arm 5...

OESA-2025-2756 containerd security update

containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

CVE-2025-64061

Primakon Pi Portal 1.0.18 /api/v2/users endpoint is vulnerable to unauthorized data exposure due to deficient access control mechanisms. Any authenticated user, regardless of their privilege level including standard or low-privileged users, can make a GET request to this endpoint and retrieve a...

CVE-2025-34333

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 configure the web document root at C:\\F2MAdmin\\F2E with overly permissive file system permissions. Authenticated local users have modify rights on this directory, while the associated web server process...

TencentOS Server 4: csmock (TSSA-2025:0581)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0581 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Mattermost Server < 11.0.0 Multiple Vulnerabilities (MMSA-2024-00337, MMSA-2025-00493, MMSA-2025-00540)

The version of Mattermost Server installed on the remote host is affected by multiple vulnerabilities as referenced in the MMSA-2024-00337, MMSA-2025-00493, MMSA-2025-00540 advisory. - Mattermost versions 11 fail to properly restrict access to archived channel search API which allows guest users ...

CVE-2025-65033

Rallly prior to 4.5.4 contains an authorization flaw in the poll management feature: polls are identified only by pollId, and ownership is not verified. This allows any authenticated user to pause or resume any poll, compromising integrity and availability. The issue has been patched in version 4...

EUVD-2025-198232

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the poll management feature allows any authenticated user to pause or resume any poll, regardless of ownership. The system only uses the public pollId to identify polls, and it does not...

CVE-2025-65028 Rallly Has an IDOR Vulnerability in Vote Update Endpoint Allows Unauthorized Manipulation of Participant Votes

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference IDOR vulnerability allows any authenticated user to modify other participants’ votes in polls without authorization. The backend relies solely on the participantId parameter to...

CVE-2025-53360

pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. In versions prior to 1.0.3, any authenticated user could send requests to agents. This issue has been patched in version 1.0.3...

CVE-2025-46775

A debug messages revealing unnecessary information vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated user to obtain administrator credentials via debug log...

CVE-2025-64996 Overly broad file permissions in the mk_inotify plugin allows reading and manipulating the plugin's output

In Checkmk versions prior to 2.4.0p16, 2.3.0p41, and all versions of 2.2.0 and older, the mkinotify plugin creates world-readable and writable files, allowing any local user on the system to read the plugin's output and manipulate it, potentially leading to unauthorized access to or modification ...

CVE-2025-64996

Checkmk vulnerable component: mk_inotify plugin. Affected in versions before 2.4.0p16, 2.3.0p41, and all 2.2.0 and older. The plugin creates world-readable/writable files, allowing any local user to read its output and modify it, potentially leading to unauthorized access to or modification of mo...

CVE-2025-41116

When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is...