PT-2025-46206

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.5.0-alpha.5 Description Parse Server, an open-source backend deployable on Node.js infrastructures, allows any client to execute MongoDB explain queries without requiring the master key. The explain method...

Parse Server 安全漏洞

Parse Server is an open source backend for Parse Platform Open Source that can be deployed to any infrastructure that can run Node.js. A security vulnerability exists in Parse Server versions prior to 8.5.0-alpha.5, which stems from allowing any client to execute an explain query without a master...

PT-2025-45599

Name of the Vulnerable Software and Affected Versions GNU libmicrohttpd versions prior to 1.0.2 Description A flaw exists in GNU libmicrohttpd that involves a NULL pointer dereference. This issue affects versions 1.0.2 and earlier. A crafted network packet sent by an attacker could lead to a...

PT-2026-25794

Name of the Vulnerable Software and Affected Versions FFmpeg versions 8.0 and 8.0.1 Description An out-of-bounds read issue exists in the RV60 video decoder libavcodec/rv60dec.c of FFmpeg versions 8.0 and 8.0.1. The issue stems from insufficient validation of the quantization parameter qp at line...

valkey security update

An update is available for valkey. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Valkey is an advanced key-value store. It is often referred to as a data...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the jsarraybufferslice function. An attacker can access sensitive information or cause application instability by triggering a buffer over-read through crafted input. Remediation A fix was pushed into the...

[SECURITY] Fedora 43 Update: python-inline-snapshot-0.30.1-1.fc43

Golden master/snapshot/approval testing library which puts the values right into your source code...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-989619)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989619 advisory. In the Linux kernel, the following vulnerability has been resolved: fscrypt: stop using keyrings subsystem for fscryptmasterkey The approach of fs/crypto/ internally...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989483)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989483 advisory. In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035i2cmasterxfer In af9035i2cmasterxfer, msg ...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990326)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990326 advisory. In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix miss free initdynaddr at i3cmasterputi3caddrs if dev-boardinfo &&...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989396)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989396 advisory. In the Linux kernel, the following vulnerability has been resolved: drm: Fix use-after-free read in drmgetunique There is a time-of-check-to-time-of-use error in...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989572)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989572 advisory. In the Linux kernel, the following vulnerability has been resolved: rtnetlink: make sure to refresh masterdev/mops in rtnlnewlink While looking at one unrelated syzb...

WordPress Master Blocks plugin <= 1.4.1.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary plugin Upload vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary plugin Upload vulnerability discovered by theviper17y in WordPress Plugin Master Blocks versions = 1.4.1.3...

SUSE CVE-2025-40068

In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: Fix integer overflow in rununpack The MFT record relative to the file being opened contains its runlist, an array containing information about the file's location on the physical disk. Analysis of all Call Stack paths...

PT-2025-44289

Name of the Vulnerable Software and Affected Versions Jenkins Azure CLI Plugin versions 0.9 and earlier Description The Jenkins Azure CLI Plugin does not restrict the commands it executes on the Jenkins controller. This allows attackers with Item/Configure permission to execute arbitrary shell...

AZL-68933 CVE-2025-40068 affecting package kernel for versions less than 6.6.112.1-2

In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: Fix integer overflow in rununpack The MFT record relative to the file being opened contains its runlist, an array containing information about the file's location on the physical disk. Analysis of all Call Stack paths...

CVE-2025-40068 fs: ntfs3: Fix integer overflow in run_unpack()

In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: Fix integer overflow in rununpack The MFT record relative to the file being opened contains its runlist, an array containing information about the file's location on the physical disk. Analysis of all Call Stack paths...

CVE-2025-40068

CVE-2025-40068 is a Linux kernel issue in the NTFS3 run_unpack() path where the MFT runlist values could overflow during decoding. This comes from unvalidated runlist data, potentially allowing access to arbitrary disk data or data destruction. The issue note confirms an overflow check for additi...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the endpoint parameter in Headless API. An attacker can perform unauthorized actions by tricking a user into making unintended requests. Remediation A fix was pushed into the master branch but not yet...

Division by zero

Overview Affected versions of this package are vulnerable to Division by zero via the CLAHEImage function in MagickCore/enhance.c. An attacker can cause the process to crash or exhaust system resources by supplying crafted parameters or very small images that result in zero tile dimensions, leadi...