935 matches found
PT-2025-46917
Name of the Vulnerable Software and Affected Versions grist-core versions prior to 1.7.7 Description grist-core is a spreadsheet hosting server. A user with limited read access to a document could access endpoints that reveal hashes for different versions of the document and obtain a complete lis...
mruby 资源管理错误漏洞
mruby is a lightweight implementation of the Ruby language open-sourced by makesoftwaresafe. A resource management error vulnerability exists in mruby 3.4.0 and earlier versions, which stems from a post-release reuse issue with the sortcmp function in the file src/array.c. The vulnerability is...
CVE-2025-64753: Incorrect Authorization
grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or...
PT-2025-46841
A vulnerability has been found in mruby up to 3.4.0. This vulnerability affects the function sort cmp of the file src/array.c. Such manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The name of the patch is...
EUVD-2025-124945
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid NULL pointer dereference in f2fscheckquotaconsistency syzbot reported a f2fs bug as below: Oops: gen 107.736417 T5848 Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 ...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990865)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990865 advisory. In the Linux kernel, the following vulnerability has been resolved: MIPS: cevt-r4k: Don't call getc0compareint if timer irq is installed This avoids warning: 0.11805...
kernel: RDMA/mlx5: Fix implicit ODP use after free
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix implicit ODP use after free Prevent double queueing of implicit ODP mr destroy work by using xacmpxchg to make sure this is the only time we are destroying this specific mr. Without this change, we could try to...
EUVD-2025-36990
In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplusstrcasecmp The hfsplusstrcasecmp logic can trigger the issue: 117.317703 T9855 ================================================================== 117.318353 T9855 BUG: KASAN:...
UBUNTU-CVE-2025-40088
In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplusstrcasecmp The hfsplusstrcasecmp logic can trigger the issue: 117.317703 T9855 ================================================================== 117.318353 T9855 BUG: KASAN:...
EUVD-2025-36498
In the Linux kernel, the following vulnerability has been resolved: pinctrl: check the return value of pinmuxops::getfunctionname While the API contract in docs doesn't specify it explicitly, the generic implementation of the getfunctionname callback from struct pinmuxops -...
ALSA-2025:19103 Moderate: kernel-rt security update
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: Bluetooth: L2CAP: fix "bad unlock balance" in l2capdisconnectrsp CVE-2023-53297 kernel: efivarfs: Fix slab-out-of-bounds in...
KVM: x86: Use __try_cmpxchg_user() to update guest PTE A/D bits
...
EulerOS 2.0 SP13 : grub2 (EulerOS-SA-2025-2261)
According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GNU GRUB aka GRUB2 through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem.CVE-2024-56737 GNU GRUB a...
CVE-2025-12004
CVE-2025-12004 affects MediaWiki with the Lockdown Extension (vulnerable: Lockdown Extension before 1.42). The issue is an incorrect permission assignment for a critical resource, enabling privilege abuse. The vulnerability is fixed in MediaWiki Core Action API (upgrade to a version including the...
CVE-2025-12004 The compare API module breaks Extension:Lockdown
Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Extension allows Privilege Abuse. Fixed in Mediawiki Core Action APIThis issue affects Mediawiki - Lockdown Extension: from master before 1.42...
CVE-2025-12004 The compare API module breaks Extension:Lockdown
Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Extension allows Privilege Abuse. Fixed in Mediawiki Core Action APIThis issue affects Mediawiki - Lockdown Extension: from master before 1.42...
PT-2025-42865
Name of the Vulnerable Software and Affected Versions Mediawiki - Lockdown Extension versions prior to 1.42 Description The Mediawiki Lockdown Extension contains a flaw related to incorrect permission assignment for critical resources, which allows for privilege abuse. The issue resides in the...
kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
A slab-out-of-bounds exists in the linux kernel in efivarfsdcompare, such that the issue can be triggered by parallel lookups using an invalid filename due to an incorrect memcmp function...