CVE-2025-38090 drivers/rapidio/rio_cm.c: prevent possible heap overwrite

In the Linux kernel, the following vulnerability has been resolved: drivers/rapidio/riocm.c: prevent possible heap overwrite In riocmcdevioctlRIOCMCHANSEND - cmchanmsgsend - riocmchsend cmchanmsgsend checks that userspace didn't send too much data but riocmchsend failed to check that userspace se...

CVE-2025-38087

The CVE-2025-38087 entry refers to a Linux kernel vulnerability in net/sched: taprio_dev_notifier, where a race with advance_sched could cause a use-after-free because taprio_dev_notifier() was not protected by an RCU read-side critical section. The issue is resolved by adding an rcu_read_lock() ...

RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Moderate) (RHSA-2025:9975)

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:9975 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can...

PT-2025-27468 · Delta Electronics · Dtn Soft

Name of the Vulnerable Software and Affected Versions: Delta Electronics DTN Soft Project File affected versions not specified Description: The Delta Electronics DTN Soft application is susceptible to remote code execution due to the deserialization of untrusted data during the parsing of project...

PT-2025-27396 · Honor · Honor Pc Manager

Name of the Vulnerable Software and Affected Versions: Honor PC Manager version 16.0.0.118 Description: A privilege escalation issue was discovered in Honor PC Manager, where several services connect to the named pipe iMateBookAssistant with default or overly permissive security attributes...

CVE-2025-53091

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in version 3.3.3 the almox parameter of the /controle/getProdutosPorAlmox.php endpoint. This issue allows any unauthenticated...

CLSA-2025-1751142056 rsync: Fix of CVE-2024-12747

CVE-2024-12747: fix symlink race condition in sender...

CLSA-2025-1751133361 open-vm-tools: Fix of CVE-2025-22247

CVE-2025-22247: prevent usage of illegal characters in user names and file paths...

CVE-2025-38086

In the Linux kernel, the following vulnerability has been resolved: net: ch9200: fix uninitialised access during miinwayrestart In miinwayrestart the code attempts to call mii-mdioread which is ch9200mdioread. ch9200mdioread utilises a local buffer called "buff", which is initialised with...

CVE-2025-38085

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugepmdunshare vs GUP-fast race hugepmdunshare drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in...

CVE-2025-38086

In the Linux kernel, the following vulnerability has been resolved: net: ch9200: fix uninitialised access during miinwayrestart In miinwayrestart the code attempts to call mii-mdioread which is ch9200mdioread. ch9200mdioread utilises a local buffer called "buff", which is initialised with...

CVE-2025-38085 mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugepmdunshare vs GUP-fast race hugepmdunshare drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in...

Security Bulletin: The SNI is incorrect when more than one channel connects through an IBM MQ IPT client route

Summary IBM MQ has addressed an authentication bypass vulnerability in IBM MQ IPT CVE-2025-33181 Vulnerability Details CVEID:CVE-2025-33181 DESCRIPTION: CWE:CWE-295: Improper Certificate Validation CVSS Source: IBM CVSS Base score: 5.9 CVSS Vector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N...

SUSE SLES15 Security Update : kernel (Live Patch 35 for SLE 15 SP4) (SUSE-SU-2025:02155-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2025:02155-1 advisory. This update for the Linux Kernel 5.14.21-15040024147 fixes one issue. The following security issue was fixed: - CVE-2024-56601: net: inet: do not leav...

SUSE SLES15 / openSUSE 15 Security Update : apache-commons-fileupload (SUSE-SU-2025:02159-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02159-1 advisory. Upgrade to upstream version 1.6.0 - CVE-2025-48976: Fixed allocation of resources for multipart headers with insufficient...

Security Bulletin: This Power System update is being released to address CVE-2023-1206

Summary The Linux kernel is used by the Virtualization Management Interface in PowerVM to support network communication with the Hardware Management Console. This bulletin provides a remediation for the impacted vulnerability, CVE-2023-1206, by upgrading PowerVM and thus addressing the exposure t...

WordPress JetEngine plugin <= 3.7.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by stealthcopter in WordPress Plugin JetEngine versions = 3.7.0...

Security Bulletin: IBM Sterling Connect:Direct Web Services vulnerable to spring-security-core-6.4.3.jar (CVE-2025-41232)

Summary IBM Sterling Connect:Direct Web Services is vulnerable to a Protection Mechanism Failure in Spring Security v6.4.3. This has been addressed in new fixpacks available from Fix Central. Vulnerability Details CVEID:CVE-2025-41232 DESCRIPTION: Spring Security Aspects may not correctly locate...

SUSE SLES15 Security Update : postgresql15 (SUSE-SU-2025:01748-2)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:01748-2 advisory. Upgrade to 15.13: - CVE-2025-4207: Fixed PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fail...

PT-2025-27254 · Unknown · Espasyncwebserver

Name of the Vulnerable Software and Affected Versions: ESPAsyncWebServer versions up to and including 3.7.8 Description: A CRLF injection vulnerability exists in the construction and output of HTTP headers within AsyncWebHeader.cpp. Unsanitized input allows attackers to inject CR r or LF characte...