CVE-2023-54030

In the Linux kernel, the following vulnerability has been resolved: iouring/net: don't overflow multishot recv Don't allow overflowing multishot recv CQEs, it might get out of hand, hurt performance, and in the worst case scenario OOM the task...

CVE-2022-50697 mrp: introduce active flags to prevent UAF when applicant uninit

In the Linux kernel, the following vulnerability has been resolved: mrp: introduce active flags to prevent UAF when applicant uninit The caller of deltimersync must prevent restarting of the timer, If we have no this synchronization, there is a small probability that the cancellation will not be...

Security update for cheat (important)

openSUSE Security Update: Security update for cheat Announcement ID: openSUSE-SU-2025:0482-1 Rating: important References: 1247629 1253593 1253922 1254051 Cross-References: CVE-2023-48795 CVE-2025-21613 CVE-2025-21614 CVE-2025-22869 CVE-2025-22870 CVE-2025-47913 CVE-2025-47914 CVE-2025-58181 CVSS...

PT-2025-52935

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.0.0-rc6-syzkaller-00321-g105a36f3694e Description The Linux kernel contains an issue within the io uring/rw subsystem. Specifically, the code was calling fsnotify functions from an inappropriate context, leadin...

CLSA-2025-1766499581 exiv2: Fix of CVE-2025-54080

CVE-2025-54080: fix insufficient bounds checking...

AZL-72989 CVE-2025-68342 affecting package kernel for versions less than 6.6.119.3-1

In the Linux kernel, the following vulnerability has been resolved: can: gsusb: gsusbreceivebulkcallback: check actuallength before accessing data The URB received in gsusbreceivebulkcallback contains a struct gshostframe. The length of the data after the header depends on the gshostframe hf::fla...

Fedora 42 : gobuster (2025-36b3527937)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-36b3527937 advisory. Fixes CVE-2025-58188, unretire package and update to 3.8.2. Tenable has extracted the preceding description block directly from the Fedora security advisory...

SUSE CVE-2025-64718

js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution proto. All users who parse untrusted yaml documents may be impacted. The problem is patched in...

CLSA-2025-1766137116 Fix CVE(s): CVE-2025-6020

Reworked CVE-2025-6020 patches to preserve ABI compatibility - Add pammodutilsanitizehelperfds as a static inline helper in the header for modules - Keep the exported pammodutilsanitizehelperfds in libpam as a wrapper that calls the new helper...

CLSA-2025-1766136361 exiv2: Fix of CVE-2025-55304

CVE-2025-55304: add new method appendIccProfile to fix quadratic performance issue...

Fedora: Security Advisory (FEDORA-2025-ebfdef0115)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-52500

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.7.0 Description Langflow is a tool for building and deploying AI-powered agents and workflows. Before version 1.7.0, specifying an arbitrary path in the request body's fs path allows server-side file creation or...

Fedora: Security Advisory (FEDORA-2025-27f16898ba)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE CVE-2025-68304

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: lookup hciconn on RX path on protocol side The hdev lock/lookup/unlock/use pattern in the packet RX path doesn't ensure hciconn is not concurrently modified/deleted. This locking appears to be leftover from...

CVE-2025-46282

The issue was addressed with additional permissions checks. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. An app may be able to access sensitive user data...

CVE-2025-68270

The Open edX Platform is a learning management platform. Prior to commit 05d0d0936daf82c476617257aa6c35f0cd4ca060, CourseLimitedStaffRole users are able to access and edit courses in studio if they are granted the role on an org rather than on a course, and CourseLimitedStaffRole users are able t...

CVE-2025-46295

Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applications passed untrusted input into the text-substitution API. Because some interpolators could trigger actions like executing commands or accessing external resources, an attacker could...

CVE-2025-68130

tRPC allows users to build and consume fully typesafe APIs without schemas or code generation. Starting in version 10.27.0 and prior to versions 10.45.3 and 11.8.0, a A prototype pollution vulnerability exists in @trpc/server's formDataToObject function, which is used by the Next.js App Router...

kernel: ALSA: usb-audio: Validate UAC3 power domain descriptors, too

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too...

kernel: iomap: iomap: fix memory corruption when recording errors during writeback

In the Linux kernel, the following vulnerability has been resolved: iomap: iomap: fix memory corruption when recording errors during writeback Every now and then I see this crash on arm64: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000f8 Buffer I/O error on dev...