Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988706)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988706 advisory. In the Linux kernel, the following vulnerability has been resolved: phy: phy-mtk-tphy: Fix some resource leaks in mtkphyinit Use clkdisableunprepare in the error pat...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988985)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988985 advisory. In the Linux kernel, the following vulnerability has been resolved: media: cx25821: Fix the warning when removing the module When removing the module, we will get th...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988800)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988800 advisory. In the Linux kernel, the following vulnerability has been resolved: tty: Fix a possible resource leak in icomprobe When pcireadconfigdword failed, call...

GHSA-CRVM-XJHM-9H29 OctoPrint vulnerable to XSS in Action Commands Notification and Prompt

Impact OctoPrint versions up to and including 1.11.3 are affected by a vulnerability that allows injection of arbitrary HTML and JavaScript into Action Command notification and prompt popups generated by the printer. An attacker who successfully convinces a victim to print a specially crafted fil...

CVE-2025-20732

The CVE-2025-20732 entry describes a local privilege-escalation flaw in the wlan AP driver (Linksys Wireless Network Controller Driver) caused by an incorrect bounds check that enables an out-of-bounds write. Impact is local, with no user interaction required, and exploitation is not detailed in ...

Radiometrics VizAir 访问控制错误漏洞

Radiometrics VizAir is a weather monitoring and warning system from Radiometrics, Inc. An access control error vulnerability exists in Radiometrics VizAir that originates from unauthenticated access to the administration panel of the VizAir system, which could result in modification of critical...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the /api/v1/usage-report/summary endpoint. An attacker can access aggregate API usage counts by sending unauthenticated requests to this endpoint, potentially revealing information about service activity or...

lakeFS affected by unauthenticated access to API usage metrics

Impact Missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime. Patches Upgrade to v1.70.1 Workarounds Any ONE of these is...

GHSA-H238-5MWF-8XW8 lakeFS affected by unauthenticated access to API usage metrics

Impact Missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime. Patches Upgrade to v1.70.1 Workarounds Any ONE of these is...

PT-2025-53014

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description The Linux kernel’s Panthor DRM driver contains a use-after-free issue. The panthor fw unplug function frees firmware memory sections, but pending firmware events may still be processing ...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: comedi: pcl812: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: c if 1 options1 & board-irqbits However, it-optionsi is an unchecked int value from userspace, so the shift amount...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Prevents recovery work from being queued during device removal. Use disableworksync instead of cancelworksync in ivpudevfini to ensure that no new recovery work items can be queued after device removal has started...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: phy: tegra: xusb: Fixed unbalanced regulator disabling in UTMI PHY mode When transitioning from USBROLEDEVICE to USBROLENONE, the code assumed that the regulator should be disabled. However, if the regulator is marked as always-o...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net:kcm: A race condition was fixed in kcmunattach. syzbot identified a race condition when kcmunattachpsock and kcmreleasekcm are executed simultaneously. The kcmunattach function lacks a check for the kcm-txstopped flag before...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: drm/mediatek: Added error handling for the old state CRTC in atomicdisable. Introduced error handling to address a issue where, after a hotplug event, the cursor continues to update. This situation can lead to a kernel panic d...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: soc: aspeed: lpc-snoop: Do not disable channels that are not enabled. The following issues have been mitigated: echo 1e789080.lpc-snoop /sys/bus/platform/drivers/aspeed-lpc-snoop/unbind ... 120.363594 Unable to handle a NULL...

CVE-2025-12367

The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.3.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Author-level...

CVE-2025-12367 SiteSEO – SEO Simplified <= 1.3.1 - Missing Authorization to Authenticated (Author+) Plugin Settings Update

The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.3.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Author-level...

CVE-2025-8850

In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication 2FA flow. The system allows users to disable 2FA without requiring a valid OTP or backup code, bypassing the intended verification process. This vulnerability occurs because the backend do...

OESA-2025-2606 squid security update

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests. Security Fixes: Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact...