Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2023-52927: netfilter: allow exp not to be removed in nfctfindexpectation bsc1239644. CVE-2024-28956: x86/ibt: Keep IBT disabled during...

CLSA-2025-1749548768 Update of alt-php

Bump ABI 4.15.0-248...

CLSA-2025-1749548339 Update of alt-php

Bump ABI 4.4.0-275...

The vulnerability of the Inedo ProGet package management system lies in its ability to bypass the authentication process by using an alternative path or channel. This allows a perpetrator to cause a service failure or disclose protected information.

The vulnerability of the Inedo ProGet package management system relates to bypassing the authentication process by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to cause service failures or disclose protected information...

Parallel Kac'S Walk Generates PRU

Ma and Huang recently proved that the PFC construction, introduced by Metger, Poremba, Sinha and Yuen MPSY24, gives an adaptive-secure pseudorandom unitary family PRU. Their proof developed a new path recording technique MH24. In this work, we show that a linear number of sequential repetitions o...

CVE-2024-32701

Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through = 0.1.0.24...

CVE-2022-38176

An issue was discovered in YSoft SAFEQ 6 before 6.0.72. Incorrect privileges were configured as part of the installer package for the Client V3 services, allowing for local user privilege escalation by overwriting the executable file via an alternative data stream. NOTE: this is not the same as...

CVE-2021-32742

Vapor is a web framework for Swift. In versions 4.47.1 and prior, bug in the Data.initbase32Encoded: function opens up the potential for exposing server memory and/or crashing the server Denial of Service for applications where untrusted data can end up in said function. Vapor does not currently...

CVE-2020-3916

An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, watchOS 6.2. Setting an alternate app icon may disclose a photo without needing permission to access photos...

RUSTSEC-2025-0036 surf is unmaintained

The developer has indicated that the crate is unmaintained. The last release is over three years old from 2021, the crate depends on the deprecated async-std crate and on a very old version of rustls for TLS support. Possible alternatives - reqwest - ureq...

PT-2025-21911 · Crates.Io · Surf

The developer has indicated that the crate is unmaintained. The last release is over three years old from 2021, the crate depends on the deprecated async-std crate and on a very old version of rustls for TLS support. Possible alternatives - reqwest - ureq...

CVE-2025-30147

Hyperledger Besu relies on besu-native to implement ALTBN128_ADD, ALTBN128_MUL, and ALTBN128_PAIRING precompiles. From Besu 24.7.1 through 25.2.2 (besu-native 0.9.0–1.2.1), a consensus bug could arise because the gnark-crypto bn254 implementation used for these precompiles did not perform proper ...

Do Not Install the TFTP Client

Trivial File Transfer Protocol TFTP is used for file transfer between a Linux server and other servers, desktop systems, as well as terminal devices. TFTP does not support authentication and encryption mechanisms. Data tends to be forged, tampered with, or stolen by attackers during communication...

SUSE CVE-2012-6153

http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via...

CVE-2025-26796

UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Oozie. This issue affects Apache Oozie: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended t...

CVE-2025-26796 Apache Oozie: XSS in Oozie Web Console

UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Oozie. This issue affects Apache Oozie: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended t...

PT-2025-12322 · Unknown · Langgenius/Dify

Name of the Vulnerable Software and Affected Versions: langgenius/dify version 0.10.1 Description: A weakness in the pseudo-random number generator PRNG used for generating password reset codes allows an attacker to take over any account, including administrator accounts. The application utilizes...

编号撤回

LocalAI is a free, open-source alternative to OpenAI by the individual developer Ettore Di Giacinto. This CVE number has been withdrawn...

RUSTSEC-2025-0014 humantime is unmaintained

Latest humantime crates.io release is four years old and GitHub repository has not seen commits in four years. Question about maintenance status has not gotten any reaction from maintainer: https://github.com/tailhook/humantime/issues/31 Update: maintained again The maintainer has responded and...

The vulnerability of the Mozilla Firefox Focus browser, related to bypassing the authentication process through an alternative path or channel, allows attackers to circumvent screen lock settings.

The vulnerability of the Mozilla Firefox Focus browser relates to bypassing the authentication process by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to circumvent screen lock settings...