Azure Linux 3.0 Security Update: kernel (CVE-2025-38365)

"The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-38365 advisory. - In the Linux kernel, the following vulnerability has been resolved: btrfs: fix a race between renames and...

CVE-2025-66803

Race condition in the turbo-frame element handler in Hotwired Turbo before 8.0.x causes logout operations to fail when delayed frame responses reapply session cookies after logout. This can be exploited by remote attackers via selective network delays e.g. delaying requests based on sequence or...

The vulnerability of the MSL (Magick Scripting Language) <write> command in the console-based graphic editor ImageMagick, which allows a hacker to trigger a service failure.

The vulnerability of the MSL Magick Scripting Language command in the console-based image editing tool ImageMagick is related to the execution of a loop with an unavailable exit condition. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the BilateralBlurImage method in the AcquireBilateralTLS function of the ImageMagick console graphics editor allows a hacker to cause a service failure.

The vulnerability of the BilateralBlurImage method in the AcquireBilateralTLS function of the ImageMagick console graphics editor is related to the release of an incorrect pointer. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

MiracleLinux 9 : postgresql:16 (AXSA:2026-063:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-063:01 advisory. postgresql: CREATE STATISTICS does not check for schema CREATE privilege CVE-2025-12817 postgresql: libpq undersizes allocations, via integer...

PT-2026-38937

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the rio scan alloc net function where rio free net was used instead of kfree during a failure in idtab allocation. Because the net is not yet registered with rio add n...

Vulnerability of the clear_decompress_residual_data() function in the RDP client FreeRDP, allowing a hacker to execute arbitrary code and cause service failure

The vulnerability of the cleardecompressresidualdata function in the RDP client FreeRDP is related to buffer overflows in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code and cause service failures...

Vulnerability of the planar_decompress_plane_rle() function in the RDP client FreeRDP, allowing a hacker to execute arbitrary code and cause service failure.

The vulnerability of the planardecompressplanerle function in the FreeRDP RDP client is related to buffer overflow in the dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code and cause service failure...

Restore to Google Compute Engine Fails with API Errors When Using Helper Appliance

Resolved in Veeam Backup & Replication 13.1.0.411 The issue discussed in this article was resolved starting in Veeam Backup & Replication 13.1 build 13.1.0.411. The article remains active to help customers who have not updated their Veeam Backup & Replication deployment and remain on the previous...

The vulnerability of the clear_decompress() function in the RDP client FreeRDP allows a hacker to execute arbitrary code and trigger a service failure.

The vulnerability of the cleardecompress function in the RDP client FreeRDP is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code and cause service interruptions...

Vulnerability of the update_pointer_new() function in the RDP client FreeRDP, allowing a hacker to execute arbitrary code and cause a service failure

The vulnerability of the updatepointernew function in the RDP client FreeRDP relates to the possibility of using memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code and cause service failures...

The vulnerability of the Glyph_Alloc() function in the RDP client FreeRDP allows a hacker to trigger a service failure.

The vulnerability of the GlyphAlloc function in the RDP client of FreeRDP is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

GHSA-63M5-974W-448V Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment

Summary A vulnerability in Fleet’s Windows MDM enrollment flow could allow an attacker to submit forged authentication tokens that are not properly validated. Because JWT signatures were not verified, Fleet could accept attacker-controlled identity claims, enabling enrollment of unauthorized...

CVE-2025-66803

Race condition in the turbo-frame element handler in Hotwired Turbo before 8.0.x causes logout operations to fail when delayed frame responses reapply session cookies after logout. This can be exploited by remote attackers via selective network delays e.g. delaying requests based on sequence or...

CVE-2026-23721

OpenProject is an open-source, web-based project management software. When using groups in OpenProject to manage users, the group members should only be visible to users that have the View Members permission in any project that the group is also a member of. Prior to versions 17.0.1 and 16.6.5, d...

ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails

The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails...

CVE-2025-36063

IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system...

CVE-2026-22770

ImageMagick is free and open-source software used for editing and manipulating digital images. The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But, in versions prior to 7.1.2-13, the last element in the set is not properly initialized. This will...

UBUNTU-CVE-2026-22770

ImageMagick is free and open-source software used for editing and manipulating digital images. The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But, in versions prior to 7.1.2-13, the last element in the set is not properly initialized. This will...

CVE-2026-22770

ImageMagick is free and open-source software used for editing and manipulating digital images. The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But, in versions prior to 7.1.2-13, the last element in the set is not properly initialized. This will...