JLSEC-2025-82 libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation...

libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when...

OESA-2025-2427 fetchmail security update

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC for retrieval...

CVE-2025-60855

Reolink Video Doorbell WiFi DB566128M5MPW performs insufficient validation of firmware update signatures. This allows attackers to load malicious firmware images, resulting in arbitrary code execution with root privileges. NOTE: this is disputed by the Supplier because the integrity of updates is...

Rockwell Automation Compact GuardLogix 5370 Denial of Service Vulnerability

Rockwell Automation Compact GuardLogix 5370 is a safety programmable logic controller from Rockwell Automation. The Rockwell Automation Compact GuardLogix 5370 suffers from a denial of service vulnerability that originates from a failure when sending a specially crafted CIP unconnected explicit...

PT-2025-51617

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak can occur in the Linux kernel when of genpd add provider onecell fails during probe. This happens because generic power domains are not removed, potentially leading to a...

The vulnerability of the Windows operating system’s Search Service allows a perpetrator to trigger a service failure.

The vulnerability of the Windows operating system’s Search Service is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure...

SUSE CVE-2025-39995

In the Linux kernel, the following vulnerability has been resolved: media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe The state-timer is a cyclic timer that schedules worki2cpoll and delayedworkenablehotplug, while rearming itself. Using timerdelete fails to guarantee...

CVE-2025-60013

When a user attempts to initialize the rSeries FIPS module using a password with special shell metacharacters, the FIPS hardware security module HSM may fail to initialize. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-58073

Mattermost Server (versions 10.11.x up to 10.11.1, 10.10.x up to 10.10.2, 10.5.x up to 10.5.10) is affected by CVE-2025-58073 due to insufficient verification of a user’s permission to join a team when using the original invite token. The underlying issue is the lack of proper authorization check...

CVE-2025-58075 Arbitrary Mattermost Team can be joined by manipulating the SAML RelayState

Mattermost versions 10.11.x = 10.11.1, 10.10.x = 10.10.2, 10.5.x = 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the RelayState...

The vulnerability of the fwnet_finish_incoming_packet() function in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the fwnetfinishincomingpacket function in the Linux operating system is related to the use of memory after it has been freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

The vulnerability of the recv() function in the tls kernel component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the recv function in the tls component of the Linux operating system’s kernel is related to an unreachable exit condition. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

The vulnerability of the mt76_dma_tx_cleanup() function in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the mt76dmatxcleanup function in the Linux operating system is related to a potential memory leak. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the sk_msg_free() function in the net/ipv4/af_inet.c file of the Linux operating system allows a attacker to cause a service failure.

The vulnerability of the skmsgfree function in the net/ipv4/afinet.c file of the Linux operating system’s kernel is related to the unlimited distribution of resources. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the imx_dsp_rproc() function in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the imxdsprproc function in the Linux operating system is related to errors during resource release. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the vlan_get_protocol_and_depth() function in the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability of the vlangetprotocolanddepth function in the Linux operating system is related to incorrect error handling. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability in the `drivers/scsi/ses.c` module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability in the drivers/scsi/ses.c module of the Linux operating system is related to resource management errors. Exploiting this vulnerability can allow an attacker to cause service failures...

go-witness is Vulnerable to Improper Verification of AWS EC2 Identity Documents

Impact This vulnerability only affects users of the AWS attestor. Users of the AWS attestor could have unknowingly received a forged identity document. While this may seem unlikely, AWS recently issued a security bulletin about IMDS Instance Metadata Service impersonation.^1 There are multiple...

CVE-2025-62410 --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom

In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads ...

Netty has SMTP Command Injection Vulnerability that Allows Email Forgery

Summary An SMTP Command Injection CRLF Injection vulnerability in Netty's SMTP codec allows a remote attacker who can control SMTP command parameters e.g., an email recipient to forge arbitrary emails from the trusted server. This bypasses standard email authentication and can be used to...