Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987663)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987663 advisory. In the Linux kernel, the following vulnerability has been resolved: powerpc: Fix virtaddrvalid for 64-bit Book3E & 32-bit mpe: On 64-bit Book3E vmalloc space starts...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987549)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987549 advisory. In the Linux kernel, the following vulnerability has been resolved: phy: ti: Fix missing sentinel for clkdivtable gettablemaxdiv tries to access clkdivtable array ou...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-987687)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987687 advisory. In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on iextraisize in isalive syzbot found a f2fs bug: BUG: KASAN:...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987539)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987539 advisory. In the Linux kernel, the following vulnerability has been resolved: hwmon: mlxreg-fan Return non-zero value when fan current state is enforced from sysfs Fan speed...

SUSE CVE-2025-40008

In the Linux kernel, the following vulnerability has been resolved: kmsan: fix out-of-bounds access to shadow memory Running sha224kunit on a KMSAN-enabled kernel results in a crash in kmsaninternalsetshadoworigin: BUG: unable to handle page fault for address: ffffbc3840291000 PF: supervisor read...

javaparser:parseFuzzer: Security exception in com.github.javaparser.ast.stmt.BlockStmt.accept

Project: https://github.com/javaparser/javaparser.git Detailed Report: https://oss-fuzz.com/testcase?key=6751922389581824 Project: javaparser Fuzzing Engine: libFuzzer Fuzz Target: parseFuzzer Job Type: libfuzzerasanjavaparser Platform Id: linux Crash Type: Security exception Crash Address: Crash...

kernel: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush In KVM guests with Hyper-V hypercalls enabled, the hypercalls HVCALLFLUSHVIRTUALADDRESSLIST and HVCALLFLUSHVIRTUALADDRESSLISTEX allow a guest to request...

CVE-2025-5555

creationtimestamp| type| source ---|---|--- 2025-10-20 07:34:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3m3mciklpbv2a...

CVE-2025-10363

creationtimestamp| type| source ---|---|--- 2025-10-20 07:09:16+00:00| seen| https://bsky.app/profile/infoguard-ag.bsky.social/post/3m3mb3cow722y 2025-11-01 16:18:17+00:00| seen| https://bsky.app/profile/keiwork35.bsky.social/post/3m4lfe7sv5n2l 2025-11-01 16:47:29+00:00| seen|...

PT-2025-42805

Name of the Vulnerable Software and Affected Versions Taguette versions prior to 1.5.0 Description An issue exists that allows an attacker to request a password reset email containing a malicious link. If a victim clicks the link, the attacker can set the email address. The affected API endpoint ...

Physical Address Bit Leakage on AMD SEV-SNP Systems

Revisions Revision Date| Description ---|--- 2025-10-20| Initial publication...

CVE-2025-11946

A security flaw has been discovered in LogicalDOC Community Edition up to 9.2.1. This issue affects some unknown processing of the file /frontend.jsp of the component Add Contact Page. Performing manipulation of the argument First Name/Last Name/Company/Address/Phone/Mobile results in cross site...

CVE-2025-11946 LogicalDOC Community Edition Add Contact frontend.jsp cross site scripting

A security flaw has been discovered in LogicalDOC Community Edition up to 9.2.1. This issue affects some unknown processing of the file /frontend.jsp of the component Add Contact Page. Performing manipulation of the argument First Name/Last Name/Company/Address/Phone/Mobile results in cross site...

CVE-2025-11938

ChurchCRM up to version 5.18.0 is affected by a deserialization vulnerability in the file setup/routes/setup.php. The issue arises when user-controlled values for DB_PASSWORD, ROOT_PATH, or URL are deserialized, enabling remote exploitation. Multiple connected reports consolidate this as a remote...

Exploit for Server-Side Request Forgery in Apache Solr

CVE-2021-27905 | Sr No | Title...

CVE-2025-10750

The CVE CVE-2025-10750 concerns the WordPress PowerBI Embed Reports plugin (

CVE-2025-62506

creationtimestamp| type| source ---|---|--- 2025-10-18 03:18:53+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m3gtbnsinr2a 2025-10-18 04:43:56+00:00| seen| https://bsky.app/profile/crowdcyber.bsky.social/post/3m3gxzr7lw22s 2025-10-23 10:18:17+00:00| seen|...

OpenVPN -- avoid buffer overread parsing routes or endpoints

Mikhail Khachaiants reports: socket: reject mismatched address family in getaddrgeneric. Add a family check to prevent copying address data of the wrong type, which could cause buffer over-read when parsing routes or endpoints...

libical:libical_extended_fuzzer: Global-buffer-overflow in icaltime_day_of_year

Project: https://github.com/libical/libical.git Detailed Report: https://oss-fuzz.com/testcase?key=6602960185655296 Project: libical Fuzzing Engine: afl Fuzz Target: libicalextendedfuzzer Job Type: aflasanlibical Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Address:...

CVE-2025-62419 DataEase vulnerable to JDBC URL injection in DB2 and MongoDB data source configuration

DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a JDBC URL injection vulnerability exists in the DB2 and MongoDB data source configuration handlers. In the DB2 data source handler, when the extraParams field is empty, the HOSTNAME, PORT, and DATABASE...