15221 matches found
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004332)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004332 advisory. In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write access in btrfsmapblock in...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000605)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000605 advisory. Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6 allows remote authenticated users to obtain sensitive information or...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003610)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003610 advisory. An issue was discovered in the Linux kernel before 5.0.10. SMB2negotiate in fs/cifs/smb2pdu.c has an out- of-bounds read because data structures are incompletely...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003655)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003655 advisory. A memory leak in the gscanopen function in drivers/net/can/usb/gsusb.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service memory...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003844)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003844 advisory. In the Linux kernel, the following vulnerability has been resolved: i2c: ismt: Fix an out-of-bounds bug in ismtaccess When the driver does not check the data from th...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004256)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004256 advisory. The Linux kernel before 5.4.2 mishandles ext4expandextraisize, as demonstrated by use-after-free errors in ext4expandextraisize and ext4xattrsetentry, related to...
Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001341)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001341 advisory. An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handler to...
PT-2026-25023
Name of the Vulnerable Software and Affected Versions tarfile module affected versions not specified Description The 'tarfile' module incorrectly normalizes AREGTYPE blocks to DIRTYPE when processing multi-block members like GNUTYPE LONGNAME or GNUTYPE LONGLINK. This can cause crafted tar archive...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-004116)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004116 advisory. In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write access in btrfsmapblock in...
SimFuzz: Similarity-Guided Block-Level Mutation for RISC-V Processor Fuzzing
The Instruction Set Architecture ISA defines processor operations and serves as the interface between hardware and software. As an open ISA, RISC-V lowers the barriers to processor design and encourages widespread adoption, but also exposes processors to security risks such as functional bugs...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004213)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004213 advisory. The rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5.8.9 used incomplete permission checking for access to rbd devices, which could be...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004264)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004264 advisory. Use-after-free vulnerability in fs/blockdev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging imprope...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001156)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001156 advisory. The blkcginitqueue function in block/blk-cgroup.c in the Linux kernel before 4.11 allows local users to cause a denial of service double free or possibly have...
MiracleLinux 7 : qemu-kvm-1.5.3-126.el7.5 (AXSA:2017-1328:02)
The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-1328:02 advisory. qemu-kvm is an open source virtualizer that provides hardware emulation for the KVM hypervisor. qemu-kvm acts as a virtual machine monitor together...
MiracleLinux 4 : samba4-4.2.10-11.AXS4 (AXSA:2017-2304:03)
The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-2304:03 advisory. It was found that samba did not enforce SMB signing when certain configuration options were enabled. A remote attacker could launch a...
Cross-site Scripting (XSS)
Overview svelte is a package for building web applications. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to the improper sanitazation of user input in hydratableblock function hydratable process. An attacker can execute arbitrary JavaScript in the client’s...
CVE-2025-15265 Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR)
An SSR XSS exists in async hydration when attacker‑controlled keys are passed to hydratable. The key is embedded inside a block without HTML‑safe escaping, allowing to terminate the script and inject arbitrary JavaScript. This enables remote script execution in users' browsers, with potential for...
CVE-2025-15265
CVE-2025-15265 describes an SSR XSS in Svelte’s async hydration where attacker-controlled hydratable keys are embedded into a [removed] block without HTML-safe escaping. This allows the attacker to terminate the script and inject arbitrary JavaScript, enabling remote code execution in users’ brow...
