Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993027)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993027 advisory. In the Linux kernel, the following vulnerability has been resolved: MIPS: SGI-IP27: Fix platform-device leak in bridgeplatformcreate In error case in...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992821)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992821 advisory. In the Linux kernel, the following vulnerability has been resolved: wifi: iwl4965: Add missing check for createsinglethreadworkqueue Add the check for the return val...

CVE-2025-66823

An HTML Injection vulnerability in TrueConf server 5.5.2.10813 in the conference description field allows an attacker to inject arbitrary HTML in the Create/Edit conference functionality. The payload will be triggered when the victim opens the Conference Info page conference url/info...

CVE-2025-66823

An HTML Injection vulnerability in TrueConf server 5.5.2.10813 in the conference description field allows an attacker to inject arbitrary HTML in the Create/Edit conference functionality. The payload will be triggered when the victim opens the Conference Info page conference url/info...

CVE-2025-50343

An issue was discovered in matio 1.5.28. A heap-based memory corruption can occur in MatVarCreateStruct when the nfields value does not match the actual number of strings in the fields array. This leads to out-of-bounds reads and invalid memory frees during cleanup, potentially causing a...

CVE-2025-66824

A Stored Cross-Site Scripting XSS vulnerability exists in the Meeting location field of the Create/Edit Conference functionality in TrueConf Server v5.5.2.10813. The injected payload is stored via the meetingroom parameter and executed when users visit the Conference Info page, allowing attackers...

EUVD-2022-55853

In the Linux kernel, the following vulnerability has been resolved: ext4: fix inode leak in ext4xattrinodecreate on an error path There is issue as follows when do setxattr with inject fault: localhost fsck.ext4 -fn /dev/sda e2fsck 1.46.6-rc1 12-Sep-2022 Pass 1: Checking inodes, blocks, and sizes...

EUVD-2022-55871

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix memory leak in lpfccreateport Commit 5e633302ace1 "scsi: lpfc: vmid: Add support for VMID in mailbox command" introduced allocations for the VMID resources in lpfccreateport after the call to scsihostalloc. Upon...

Pterodactyl has a Reflected XSS vulnerability in “Create New Database Host”

!NOTE Message from the Pterodactyl team: The Pterodactyl team has evaluated this as a minor security issue but does not consider it something that should be assigned a CVE, nor does it require active patching by vulnerable systems. This issue is entirely self-inflicted and requires an...

CVE-2022-50840

In the Linux kernel, the following vulnerability has been resolved: scsi: snic: Fix possible UAF in snictgtcreate Smatch reports a warning as follows: drivers/scsi/snic/snicdisc.c:307 snictgtcreate warn: '&tgt-list' not removed from list If deviceadd fails in snictgtcreate, tgt will be freed, but...

CVE-2022-50845

In the Linux kernel, the following vulnerability has been resolved: ext4: fix inode leak in ext4xattrinodecreate on an error path There is issue as follows when do setxattr with inject fault: localhost fsck.ext4 -fn /dev/sda e2fsck 1.46.6-rc1 12-Sep-2022 Pass 1: Checking inodes, blocks, and sizes...

CVE-2023-54215 virtio-vdpa: Fix cpumask memory leak in virtio_vdpa_find_vqs()

In the Linux kernel, the following vulnerability has been resolved: virtio-vdpa: Fix cpumask memory leak in virtiovdpafindvqs Free the cpumask allocated by createaffinitymasks before returning from the function...

CVE-2023-54215

CVE-2023-54215 affects the Linux kernel's virtio-vdpa subsystem. The vulnerability is a memory leak in cpumask handling within virtio_vdpa_find_vqs(), where a cpumask allocated by create_affinity_masks() was not freed on all paths. The fix ensures the allocated cpumask is freed before returning f...

CVE-2022-50840 scsi: snic: Fix possible UAF in snic_tgt_create()

In the Linux kernel, the following vulnerability has been resolved: scsi: snic: Fix possible UAF in snictgtcreate Smatch reports a warning as follows: drivers/scsi/snic/snicdisc.c:307 snictgtcreate warn: '&tgt-list' not removed from list If deviceadd fails in snictgtcreate, tgt will be freed, but...

CVE-2022-50840

The CVE-2022-50840 issue affects the Linux kernel SCSI driver snic: the code path snic_tgt_create() could trigger a use-after-free if device_add() fails, because tgt->list was not removed from snic->disc.tgt_list before freeing. The fix removes the tgt from snic->disc.tgt_list prior to f...

CVE-2022-50827

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix memory leak in lpfccreateport Commit 5e633302ace1 "scsi: lpfc: vmid: Add support for VMID in mailbox command" introduced allocations for the VMID resources in lpfccreateport after the call to scsihostalloc. Upon...

CVE-2022-50827

CVE-2022-50827 — Linux kernel (lpfc SCSI driver) memory leak fix : The issue arose in lpfc_create_port() after VMID allocations were introduced by a VMID-related patch. On VMID allocation failure, the code branched to an ‘out’ path that returned NULL without unwinding VMID resources, bypassing sc...

CVE-2022-50817 net: hsr: avoid possible NULL deref in skb_clone()

In the Linux kernel, the following vulnerability has been resolved: net: hsr: avoid possible NULL deref in skbclone syzbot got a crash 1 in skbclone, caused by a bug in hsrgetuntaggedframe. When/if createstrippedskbhsr returns NULL, we must not attempt to call skbclone. While we are at it, replac...

CVE-2025-66823

An HTML Injection vulnerability in TrueConf server 5.5.2.10813 in the conference description field allows an attacker to inject arbitrary HTML in the Create/Edit conference functionality. The payload will be triggered when the victim opens the Conference Info page conference url/info...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992212)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992212 advisory. In the Linux kernel, the following vulnerability has been resolved: wifi: iwl3945: Add missing check for createsinglethreadworkqueue Add the check for the return val...