kernel: xfrm: state: fix out-of-bounds read during lookup

In the Linux kernel, the following vulnerability has been resolved: xfrm: state: fix out-of-bounds read during lookup lookup and resize can run in parallel. The xfrmstatehashgeneration seqlock ensures a retry, but the hash functions can observe a hmask value that is too large for the new hlist...

PT-2025-46542

Name of the Vulnerable Software and Affected Versions LOGO! 12/24RCE 6ED1052-1MD08-0BA2 affected versions not specified LOGO! 12/24RCEo 6ED1052-2MD08-0BA2 affected versions not specified LOGO! 230RCE 6ED1052-1FB08-0BA2 affected versions not specified LOGO! 230RCEo 6ED1052-2FB08-0BA2 affected...

Amazon Linux 2 : oci-add-hooks, --advisory ALAS2DOCKER-2025-083 (ALASDOCKER-2025-083)

The version of oci-add-hooks installed on the remote host is prior to 0-0.5.20200504git325a340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2025-083 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted valu...

Amazon Linux 2 : docker, --advisory ALAS2ECS-2025-081 (ALASECS-2025-081)

The version of docker installed on the remote host is prior to 25.0.13-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2025-081 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6...

Siemens LOGO! 访问控制错误漏洞

Siemens LOGO! is a programmable logic controller from Siemens, Germany. An Access Control Error vulnerability exists in Siemens LOGO! where an unauthenticated, remote attacker could manipulate the IP address of the device, rendering it inaccessible. The following products are affected:...

Important: nerdctl

Issue Overview: net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed withi...

PYSEC-2025-126

Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, which can be viewed by invited users. This issue is fixed i...

CVE-2025-64326 Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log

Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, which can be viewed by invited users. This issue is fixed i...

EUVD-2025-38152

An issue was discovered in AnyDesk through 9.0.4. When the connection between two clients is established via an IP address, it is possible to manipulate the data and spoof the AnyDesk ID...

CVE-2025-27916

An issue was discovered in AnyDesk for Windows before 9.0.6 and AnyDesk for Android before 8.0.0. When the connection between two clients is established via an IP address, it is possible to manipulate the data and spoof the AnyDesk ID...

CVE-2025-61304

OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address...

Weblate 安全漏洞

Weblate is a Copyleft open source web-based free software continuous localization system. A security vulnerability exists in Weblate 5.14 and earlier versions, which stems from audit logs leaking project member IP addresses, potentially leading to information disclosure...

GHSA-GR35-VPX2-QXHC Weblate leaks the IP of project member inviting user to be reviewer in Audit log

Summary Weblate leaks the IP address of the project member inviting the user to the project in the audit log. Details The audit log included IP addresses from admin-triggered actions, and those could be viewed by invited users. Impact The inviting user's admin's IP address could be leaked to...

CVE-2025-61304

OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address...

CVE-2025-61304

OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989824)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989824 advisory. In the Linux kernel, the following vulnerability has been resolved: net: ipv6: ensure we call ipv6mcdown at most once There are two reasons for addrconfnotify to be...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988735)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988735 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid use-after-free in ip6fragment Blamed commit claimed rcureadlock was held by ip6fragme...

EUVD-2025-37901

OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989227)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989227 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix a data-race around sysctlfibsyncmem. While reading sysctlfibsyncmem, it can be changed...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989529)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989529 advisory. In the Linux kernel, the following vulnerability has been resolved: net, neigh: Fix null-ptr-deref in neightableclear When IPv6 module gets initialized but hits an...