AZL-57344 CVE-2025-22868 affecting package keda for versions less than 2.14.1-3

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

AZL-57488 CVE-2025-22869 affecting package kubevirt for versions less than 0.59.0-25

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted...

AZL-57425 CVE-2025-22868 affecting package vitess for versions less than 17.0.7-5

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

AZL-57389 CVE-2025-22868 affecting package telegraf for versions less than 1.31.0-7

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

AZL-57428 CVE-2025-22869 affecting package kubernetes for versions less than 1.28.4-15

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted...

AZL-57353 CVE-2025-22869 affecting package gh for versions less than 2.62.0-7

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted...

Drupal Cache Utility module < 1.2.1 - Unauthenticated Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF vulnerability discovered by Pierre Rudloff prudloff in WordPress Module Cache Utility versions 1.2.1...

Drupal OAuth2 Server module < 2.1.0 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Pierre Rudloff prudloff in WordPress Module OAuth2 Server versions 2.1.0...

AZL-57390 CVE-2025-26600 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-1

A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free...

AZL-57404 CVE-2025-26596 affecting package xorg-x11-server for versions less than 1.20.10-15

A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms differs from what is written in XkbWriteKeySyms, which may lead to a heap-based buffer overflow...

AZL-57479 CVE-2025-26597 affecting package xorg-x11-server for versions less than 1.20.10-15

A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because t...

AZL-57378 CVE-2025-26595 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-1

A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size...

WordPress NextGEN Gallery plugin < 3.59.9 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin NextGEN Gallery versions 3.59.9...

Google Chrome < 133.0.6943.141 Vulnerability

The version of Google Chrome installed on the remote Windows host is prior to 133.0.6943.141. It is, therefore, affected by a vulnerability as referenced in the 202502stable-channel-update-for-desktop25 advisory. Note that Nessus has not tested for this issue but has instead relied only on the...

WordPress Form Maker by 10Web plugin < 1.15.33 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Form Maker by 10Web versions 1.15.33...

WordPress Carousel, Slider, Gallery by WP Carousel plugin < 2.7.4 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Carousel, Slider, Gallery by WP Carousel versions 2.7.4...

SUSE CVE-2025-1414

Memory safety bugs present in Firefox 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135.0.1...

AZL-57025 CVE-2025-1118 affecting package grub2 for versions less than 2.06-25

A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attacker may leverage this in order to extract signatures, salts, and other sensitive information from the memory...

AZL-57052 CVE-2024-45775 affecting package grub2 for versions less than 2.06-25

A flaw was found in grub2 where the grubextcmddispatcher function calls grubarglistalloc to allocate memory for the grub's argument list. However, it fails to check in case the memory allocation fails. Once the allocation fails, a NULL point will be processed by the parseoption function, leading...

AZL-57067 CVE-2024-45774 affecting package grub2 for versions less than 2.06-25

A flaw was found in grub2. A specially crafted JPEG file can cause the JPEG parser of grub2 to incorrectly check the bounds of its internal buffers, resulting in an out-of-bounds write. The possibility of overwriting sensitive information to bypass secure boot protections is not discarded...