go1.24-1.24.5-1.1 on GA media (moderate)

go1.24-1.24.5-1.1 on GA media Announcement ID: openSUSE-SU-2025:15329-1 Rating: moderate Cross-References: CVE-2025-4674 CVSS scores: CVE-2025-4674 SUSE : 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2025-4674 SUSE : 9.3 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H...

WordPress WP Lightbox 2 plugin < 3.0.6.8 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin WP Lightbox 2 versions 3.0.6.8...

CLSA-2025-1752089633 pam: Fix of CVE-2025-6020

CVE-2025-6020: fix potential privilege escalationvia multiple symlink attacks and race conditions...

CLSA-2025-1752089185 libsoup: Fix of 3 CVEs

CVE-2025-32906: fix out-of-bound read vulnerability - CVE-2025-32911: fix use-after-free vulnerability - CVE-2025-32913: fix NULL pointer dereference...

CVE-2025-53620

The CVE-2025-53620 issue affects @builder.io/qwik-city (Qwik meta-framework) where executing a Qwik Server Action QRL may load the file containing the symbol; if an invalid qfunc is sent, the server does not handle the thrown error, causing a Node.js process exit. This is documented as a vulnerab...

CVE-2025-53525

WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the profilefamiliar.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the iddependente parameter. This vulnerability is...

CVE-2025-53377

WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the cadastrodependentepessoanova.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the idfuncionario parameter. This...

CVE-2025-38256

In the Linux kernel, the following vulnerability has been resolved: iouring/rsrc: fix folio unpinning syzbot complains about an unmapping failure: 108.070381 T14 kernel BUG at mm/gup.c:71! 108.070502 T14 Internal error: Oops - BUG: 00000000f2000800 1 SMP 108.123672 T14 Hardware name: QEMU KVM...

CVE-2025-38242

In the Linux kernel, the following vulnerability has been resolved: mm: userfaultfd: fix race of userfaultfdmove and swap cache This commit fixes two kinds of races, they may have different results: Barry reported a BUGON in commit c50f8e6053b0, we may see the same BUGON if the filemap lookup...

CVE-2025-38238

In the Linux kernel, the following vulnerability has been resolved: scsi: fnic: Fix crash in fnicwqcmplhandler when FDMI times out When both the RHBA and RPA FDMI requests time out, fnic reuses a frame to send ABTS for each of them. On send completion, this causes an attempt to free the same fram...

CVE-2025-38264

CVE-2025-38264 applies to the Linux kernel and concerns the nvme-tcp subsystem. The vulnerability arises from improper handling in nvme_tcp_handle_r2t(), where an R2T PDU could be validated as part of a list, allowing a malicious input to inject a loop in request list processing. The description ...

CVE-2025-38263

The CVE-2025-38263 issue in the Linux kernel affects the bcache subsystem, specifically a NULL pointer dereference in cache_set_flush() that could occur during error handling in register_cache_set()/bch_cache_set_alloc(). The crash path can lead to kernel oops and a NULL dereference when cache se...

CVE-2025-38258 mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: free old damonsysfsschemefilter-memcgpath on write memcgpathstore assigns a newly allocated memory buffer to filter-memcgpath, without deallocating the previously allocated and assigned memory buffer. As a...

CVE-2025-38255 lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()

In the Linux kernel, the following vulnerability has been resolved: lib/groupcpus: fix NULL pointer dereference from groupcpusevenly While testing nullblk with configfs, echo 0 pollqueues will trigger following panic: BUG: kernel NULL pointer dereference, address: 0000000000000010 Oops: Oops: 000...

CVE-2025-38249 ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out-of-bounds read in sndusbgetaudioformatuac3 In sndusbgetaudioformatuac3, the length value returned from sndusbctlmsg is used directly for memory allocation without validation. This length is controlled by...

CVE-2025-38239 scsi: megaraid_sas: Fix invalid node index

In the Linux kernel, the following vulnerability has been resolved: scsi: megaraidsas: Fix invalid node index On a system with DRAM interleave enabled, out-of-bound access is detected: megaraidsas 0000:3f:00.0: requested/available msix 128/128 pollqueue 0 ------------ cut here ------------ UBSAN:...

CVE-2025-38238

The CVE-2025-38238 issue affects the Linux kernel SCSI fnic driver, where a crash could occur when both FDMI RHBA and RPA requests time out and a frame is reused to send ABTS, leading to a double-free on completion. The fix allocates separate frames for RHBA and RPA and updates the ABTS handling ...

Vulnerabilities fixed in Adobe Framemaker

Adobe has fixed vulnerabilities in Adobe Framemaker Versions 2020.8, 2022.6 and earlier. The vulnerabilities in Adobe Framemaker are related to several types of vulnerabilities, including Heap-based Buffer Overflow, Integer Underflow, and NULL Pointer Dereference. These vulnerabilities can lead t...

libpoppler-cpp2-25.06.0-1.1 on GA media (moderate)

libpoppler-cpp2-25.06.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:15323-1 Rating: moderate Cross-References: CVE-2025-52886 CVSS scores: CVE-2025-52886 SUSE : 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-52886 SUSE : 7.3...

CVE-2025-53355

CVE-2025-53355 – Mode C summary The vulnerability affects the mcp-server-kubernetes component of MCP Server. The root cause is unsanitized input being interpolated into shell commands via a call to shell-based child_process.execSync, enabling an attacker to inject arbitrary commands and potential...