13970 matches found
CVE-2024-56766
In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix double free in atmelpmecccreateuser The "user" pointer was converted from being allocated with kzalloc to being allocated by devmkzalloc. Calling kfreeuser will lead to a double free...
AZL-55029 CVE-2024-56761 affecting package kernel for versions less than 6.6.76.1-1
In the Linux kernel, the following vulnerability has been resolved: x86/fred: Clear WFE in missing-ENDBRANCH CPs An indirect branch instruction sets the CPU indirect branch tracker IBT into WAITFORENDBRANCH WFE state and WFE stays asserted across the instruction boundary. When the decoder finds a...
CVE-2024-56764 ublk: detach gendisk from ublk device if add_disk() fails
In the Linux kernel, the following vulnerability has been resolved: ublk: detach gendisk from ublk device if adddisk fails Inside ublkabortrequests, gendisk is grabbed for aborting all inflight requests. And ublkabortrequests is called when exiting the uring context or handling timeout. If adddis...
CVE-2024-56764 ublk: detach gendisk from ublk device if add_disk() fails
In the Linux kernel, the following vulnerability has been resolved: ublk: detach gendisk from ublk device if adddisk fails Inside ublkabortrequests, gendisk is grabbed for aborting all inflight requests. And ublkabortrequests is called when exiting the uring context or handling timeout. If adddis...
CVE-2024-56763
The CVE applies to the Linux kernel tracing subsystem, specifically tracing_cpumask_write. A large count can trigger a warning in bitmap_parse_user and there is an additional zero-count check. The fix is described as: Prevent bad count for tracing_cpumask_write and also check zero for it. Connect...
CVE-2025-21613 go-git has an Argument Injection via the URL field
go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only...
electron32 -- Type Confusion in V8
Electron developers report: This update fixes the following vulnerability: Security: backported fix for CVE-2024-12053...
CVE-2025-21609
CVE-2025-21609 affects SiYuan Note 3.1.18. The vulnerability exists in the POST /api/history/getDocHistoryContent endpoint, where an attacker can craft a payload to cause arbitrary file deletion on the server. The issue is addressed by commit d9887aeec1b27073bec66299a9a4181dc42969f3, with a fix e...
OESA-2025-1008 python-jinja2 security update
Jinja2 is one of the most used template engines for Python. It is inspired by Django's templating system but extends it with an expressive language that gives template authors a more powerful set of tools. On top of that it adds sandboxed execution and optional automatic escaping for applications...
Security update for python-Jinja2
This update for python-Jinja2 fixes the following issues: CVE-2024-56201: Fixed sandbox breakout through malicious content and filename of a template bsc1234808 CVE-2024-56326: Fixed sandbox breakout through indirect reference to format method bsc1234809 Patch Instructions: To install this SUSE...
PT-2025-3336 · Openjpeg +7 · Openjpeg +7
Name of the Vulnerable Software and Affected Versions: OpenJPEG project affected versions not specified Description: A flaw was found in the OpenJPEG project, where a heap buffer overflow condition may be triggered when certain options are specified while using the opj decompress utility. This ca...
PT-2025-19756 · Chromium +3 · Chromium +3
Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 136.0.7103.59 chromium in Debian Linux affected versions not specified Description: The issue is related to insufficient data validation in DevTools, allowing a remote attacker to bypass discretionary access...
PT-2025-37864
Name of the Vulnerable Software and Affected Versions ip aka node-ip package versions through 2.0.1 Description The ip aka node-ip package may allow Server-Side Request Forgery SSRF due to the improper categorization of the IP address value 0 as globally routable via the isPublic function. This...
PT-2025-21068
Name of the Vulnerable Software and Affected Versions: IntelR Core Ultra Processors affected versions not specified Description: The issue concerns incorrect behavior order in some IntelR Core Ultra Processors, potentially allowing an unauthenticated user to enable information disclosure via...
PT-2025-30760
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue in the drm/amd/display subsystem related to DSC / HUBP ONO guarantees. For non-zero DSC instances, the HUBP domain required to drive it for sequential...
PT-2025-54197
Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-12 Description ImageMagick is software used for editing and manipulating digital images. Prior to version 7.1.2-12, reading a malicious SVG file with Magick could lead to a denial-of-service DoS attack...
PT-2025-49260
Name of the Vulnerable Software and Affected Versions urllib3 versions 1.24 through 2.5.9 Description urllib3 is a user-friendly HTTP client library for Python. In versions starting from 1.24 and prior to 2.6.0, the decompression chain had an unbounded number of links. This allowed a malicious...
CVE-2024-56198
path-sanitizer is a simple lightweight npm package for sanitizing paths to prevent Path Traversal. Prior to 3.1.0, the filters can be bypassed using .=%5c which results in a path traversal. This vulnerability is fixed in 3.1.0...
CVE-2024-56198 path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability
path-sanitizer is a simple lightweight npm package for sanitizing paths to prevent Path Traversal. Prior to 3.1.0, the filters can be bypassed using .=%5c which results in a path traversal. This vulnerability is fixed in 3.1.0...