Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986969)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986969 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock between quota disable and qgroup rescan worker Quota disable ioctl starts a...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987046)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987046 advisory. In the Linux kernel, the following vulnerability has been resolved: sfc: fix use after free when disabling sriov Use after free is detected by kfence when disabling...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986676)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986676 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: avoid disabling offload when it was never enabled In an incredibly strange API...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-392685)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-392685 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: prevent nfskbduplicated corruption syzbot found that nfdupipv4 or nfdupipv6...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-403498)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-403498 advisory. In the Linux kernel, the following vulnerability has been resolved: i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume In case there is any...

PT-2025-41166

Name of the Vulnerable Software and Affected Versions Dependency-Track versions prior to 4.13.5 Description Dependency-Track is a component analysis platform used for managing software supply chain risk. Versions prior to 4.13.5 may inadvertently transmit credentials intended for a private NuGet...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-986986)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986986 advisory. In the Linux kernel, the following vulnerability has been resolved: dmaengine: mvxorv2: Fix a resource leak in mvxorv2remove A clkprepareenable call in the probe is...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git (UTSA-2025-986161)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986161 advisory. Git is an open source, scalable, distributed revision control system. git shell is a restricted login shell that can be used to implement Git's push/pull functionali...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986386)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986386 advisory. In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when uninstalling driver When the driver is uninstalled and the VF i...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-986883)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986883 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between quota rescan and disable leading to NULL pointer deref If we have one ta...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-986619)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986619 advisory. In the Linux kernel, the following vulnerability has been resolved: pci/hotplug/pnvphp: Fix hotplug driver crash on Powernv The hotplug driver for powerpc...

XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view

Impact Anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows authentication with any user since users are very commonly viewable, at least to other registered users. Patches Version 2.18.2...

GHSA-F2HF-PFRJ-VRM7 XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view

Impact Anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows authentication with any user since users are very commonly viewable, at least to other registered users. Patches Version 2.18.2...

Kibana 8.18.8, 8.19.4, 9.0.7, 9.1.4 Security Update (ESA-2025-16)

Kibana Cross-Site-Scripting XSS ESA-2025-16 Improper Neutralization of Input During Web Page Generation in Vega visualizations in Kibana can lead to Cross-Site-Scripting XSS Affected Versions: 7.x: All versions from 7.0.0 and up to and including 7.17.29 8.x: All versions from 8.0.0 and up to and...

EUVD-2025-32541

XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows...

CVE-2025-49594

Summary : CVE-2025-49594 affects XWiki OIDC. From version 2.17.1 up to, but not including, 2.18.2, any user with VIEW access to another user’s profile can forge a token for that user. If the instance allows token authentication, this enables authentication as any user whose profile is viewable. I...

PT-2025-40900

Name of the Vulnerable Software and Affected Versions XWiki versions 2.17.1 through 2.18.1 Description XWiki OpenID Connect OIDC contains tools for manipulating the OpenID Connect protocol. Individuals with VIEW access to a user profile can generate a token for that user in versions prior to...

SUSE CVE-2022-50491

In the Linux kernel, the following vulnerability has been resolved: coresight: cti: Fix hang in ctidisablehw ctienablehw and ctidisablehw are called from an atomic context so shouldn't use runtime PM because it can result in a sleep when communicating with firmware. Since commit 3c6656337852...

smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)

...

CVE-2023-53567

In the Linux kernel, the following vulnerability has been resolved: spi: qup: Don't skip cleanup in remove's error path Returning early in a platform driver's remove callback is wrong. In this case the dma resources are not released in the error path. this is never retried later and so this is a...