CVE-2025-67725

Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using string concatenation...

Linux Distros Unpatched Vulnerability : CVE-2023-53855

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: dsa: ocelot: call dsatag8021qunregister under rtnllock on driver remove When the tagging protocol in current use is ocelot-8021q and we unbind the driver, ...

Unity Linux 20.1050e Security Update: kernel (UTSA-2025-991148)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991148 advisory. In the Linux kernel, the following vulnerability has been resolved: 9p: transfd/p9conncancel: drop client lock earlier syzbot reported a double-lock here and we no...

Unity Linux 20.1050e Security Update: kernel (UTSA-2025-991130)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991130 advisory. In the Linux kernel, the following vulnerability has been resolved: USB: core: Prevent nested device-reset calls Automatic kernel fuzzing revealed a recursive lockin...

Unity Linux 20.1050e Security Update: kernel (UTSA-2025-991145)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991145 advisory. In the Linux kernel, the following vulnerability has been resolved: tracing: Fix sleeping function called from invalid context on RT kernel When setting...

Unity Linux 20.1050e Security Update: kernel (UTSA-2025-991115)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991115 advisory. In the Linux kernel, the following vulnerability has been resolved: drivers: usb: host: Fix deadlock in oxubussuspend There is a deadlock in oxubussuspend, which is...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the Change Username process in the settings panel. An attacker can cause a user's account to be locked out by tricking the victim into visiting a malicious webpage while authenticated, which submits a...

CVE-2025-67582

Missing Authorization vulnerability in wbcomdesigns Wbcom Designs lock-my-bp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wbcom Designs: from n/a through = 2.1.1...

CVE-2023-53764

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Handle lock during peerid find ath12kpeerfindbyid requires that the caller hold the ab-baselock. Currently the WBM error path does not hold the lock and calling that function, leads to the following lockdepassertin...

CVE-2023-53777

In the Linux kernel, the following vulnerability has been resolved: erofs: kill hooked chains to avoid loops on deduplicated compressed images After heavily stressing EROFS with several images which include a hand-crafted image of repeated patterns for more than 46 days, I found two chains could ...

CVE-2023-53838

A race condition was found in the F2FS filesystem's atomic write abort handling in the Linux kernel. Concurrent atomic write abort operations lack proper synchronization, which can lead to inconsistent COW copy-on-write inode state and potential use-after-free or data corruption scenarios...

SUSE CVE-2022-50676

In the Linux kernel, the following vulnerability has been resolved: net: rds: don't hold sock lock when cancelling work from rdstcpresetcallbacks syzbot is reporting lockdep warning at rdstcpresetcallbacks 1, for commit ac3615e7f3cffe2a "RDS: TCP: Reduce code duplication in rdstcpresetcallbacks"...

SUSE CVE-2023-53826

In the Linux kernel, the following vulnerability has been resolved: ubi: Fix UAF wear-leveling entry in eraseblkcountseqshow Wear-leveling entry could be freed in error path, which may be accessed again in eraseblkcountseqshow, for example: eraseworker eraseblkcountseqshow wl =...

SUSE CVE-2023-53838

In the Linux kernel, the following vulnerability has been resolved: f2fs: synchronize atomic write aborts To fix a race condition between atomic write aborts, I use the inode lock and make COW inode to be re-usable thoroughout the whole atomic file inode lifetime...

SUSE CVE-2023-53855

In the Linux kernel, the following vulnerability has been resolved: net: dsa: ocelot: call dsatag8021qunregister under rtnllock on driver remove When the tagging protocol in current use is "ocelot-8021q" and we unbind the driver, we see this splat: $ echo '0000:00:00.2'...

SUSE CVE-2025-40332

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix mmap write lock not release If mmap write lock is taken while draining retry fault, mmap write lock is not released because svmrangerestorepages calls mmapreadunlock then returns. This causes deadlock and system...

SUSE CVE-2025-40341

In the Linux kernel, the following vulnerability has been resolved: futex: Don't leak robustlist pointer on exec race sysgetrobustlist and compatgetrobustlist use ptracemayaccess to check if the calling task is allowed to access another task's robustlist pointer. This check is racy against a...

SUSE CVE-2025-40342

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: use lock accessing portstate and rport state nvmefcunregisterremote removes the remote port on a lport object at any point in time when there is no active association. This races with with the reconnect logic, because...

Huawei HarmonyOS file management app bypasses app lock checksum vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A vulnerability exists in the Huawei HarmonyOS file management app that bypasses the application lock checksum and can be exploited by an attacker to...

PT-2026-43771

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.18.0-rc3 Description An issue in the Enhanced Error Handling EEH driver for powerpc leads to recursive locking. The function eeh handle normal event acquires the pci lock rescan remove lock before calling eeh pe bus get,...