CVE-2023-52969

CVE-2023-52969 concerns MariaDB Server crash due to an empty backtrace log, observed across multiple branches (MariaDB Server 10.4–11.0.* and 11.0.*) and related to make_aggr_tables_info and optimize_stage2. Connected advisories confirm the issue as a crash vulnerability (not a remote code execut...

CVE-2025-27508

Emissary is a P2P based data-driven workflow engine. The ChecksumCalculator class within allows for hashing and checksum generation, but it includes or defaults to algorithms that are no longer recommended for secure cryptographic use cases e.g., SHA-1, CRC32, and SSDEEP. These algorithms, while...

GHSA-4P46-PWFR-66X6 vulnerabilities

Vulnerabilities for packages: tealdeer, sccache, uv, linkerd-extension-init, shadowsocks-rust, zizmor, buck2, qdrant, kdash, rye, linkerd2-proxy, rustls-ffi, sqlx, cargo-audit, lychee, wadm, rustup, wash, parseable, samply, pixi, nushell, ntpd-rs, wasm-pack, zola, wasmcloud, xh, wasmtime, deno,...

OESA-2025-1250 python-aiohttp security update

Async http client/server framework asyncio. Security Fixes: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTPNOEXTENSION...

CVE-2025-0863 Flexmls® IDX <= 3.14.27 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'idxframe' shortcode in all versions up to, and including, 3.14.27 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-27839

The CVE affects Tangem SDK for Android (before 5.18.3) in AttestationTask.kt, where offline wallet genuineness check logic can cause verification results to be disregarded on the first card scan. The issue is limited to the first scan flow and exploitation may not have been possible; upgrading to...

CVAD: Importance of LogonTimings WMI class for reporting Logon Duration in Citrix Director

Ques: Why is LogonTimings WMI class important for reporting Logon Duration in Citrix Director? Ans: LogonTimings WMI class is crucial for monitoring and reporting logon durations in Citrix environments. It provides detailed metrics that help administrators analyze and troubleshoot logon performan...

OPENSUSE-SU-2025:14861-1 MozillaFirefox-136.0-1.1 on GA media

These are all security issues fixed in the MozillaFirefox-136.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:14862-1 less-668-2.1 on GA media

These are all security issues fixed in the less-668-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:14863-1 teleport-17.3.3-1.1 on GA media

These are all security issues fixed in the teleport-17.3.3-1.1 package on the GA media of openSUSE Tumbleweed...

GHSA-P3FP-8748-VQFQ vulnerabilities

Vulnerabilities for packages: awx...

CVE-2025-21827

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: Add locks for usbdriverclaiminterface The documentation for usbdriverclaiminterface says that "the device lock" is needed when the function is called from places other than probe. This appears to be th...

CVE-2024-58079

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix crash during unbind if gpio unit is in use We used the wrong device for the device managed functions. We used the usb device, when we should be using the interface device. If we unbind the driver from the usb...

CVE-2024-58086

CVE-2024-58086 is a Linux kernel vulnerability in the DRM/V3D driver where the active perfmon (v3d-&gt;active_perfmon) could be left dangling during destruction. The fixed behavior, as noted in the patch referenced by commit 7d1fd3638ee3, stops the active perfmon before it is destroyed, addressin...

CVE-2025-21831 PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1

In the Linux kernel, the following vulnerability has been resolved: PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 commit 9d26d3a8f1b0 "PCI: Put PCIe ports into D3 during suspend" sets the policy that all PCIe ports are allowed to use D3. When the system is suspended if the port...

CVE-2025-21831

In the Linux kernel, the following vulnerability has been resolved: PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 commit 9d26d3a8f1b0 "PCI: Put PCIe ports into D3 during suspend" sets the policy that all PCIe ports are allowed to use D3. When the system is suspended if the port...

CVE-2024-58057

In the Linux kernel, the following vulnerability has been resolved: idpf: convert workqueues to unbound When a workqueue is created with WQUNBOUND, its work items are served by special worker-pools, whose host workers are not bound to any specific CPU. In the default configuration i.e. when...

CVE-2024-58083

CVE-2024-58083 affects the Linux kernel KVM: the target vCPU was not reliably verified online before clamping the index in kvm_get_vcpu(). If the index is bad, nospec clamping could return vCPU0, leading to a use‑after‑free when vCPU0 is dereferenced. The issue is mitigated by ensuring vCPU0 is o...

CVE-2025-21828

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't flush non-uploaded STAs If STA state is pre-moved to AUTHORIZED such as in IBSS scenarios and insertion fails, the station is freed. In this case, the driver never knew about the station, so trying to flush ...

CVE-2024-58072

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: remove unused checkbuddypriv Commit 2461c7d60f9f "rtlwifi: Update header file" introduced a global list of private data structures. Later on, commit 26634c4b1868 "rtlwifi Modify existing bits to match vendor versio...