Linux Distros Unpatched Vulnerability : CVE-2025-6713

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the...

Prototype Pollution

Overview js-toml is an A TOML parser for JavaScript/TypeScript, targeting TOML 1.0.0 Spec Affected versions of this package are vulnerable to Prototype Pollution via the parsing process. An attacker can inject or modify properties on the global Object.prototype by supplying specially crafted TOML...

GHSA-XHPR-465J-7P9Q Keycloak phishing attack via email verification step in first login flow

There is a flaw with the first login flow where, during a IdP login, an attacker with a registered account can initiate the process to merge accounts with an existing victim's account. The attacker will subsequently be prompted to "review profile" information, which allows the the attacker to...

keycloak: Phishing attack via email verification step in first login flow

A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider IdP login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email...

keycloak: Phishing attack via email verification step in first login flow

A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider IdP login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email...

Prototype Pollution

Overview linkify-react is a React element interface for linkifyjs Affected versions of this package are vulnerable to Prototype Pollution via the internal assign helper due to improper filtering of the proto property. An attacker can achieve Stored or Reflected XSS by injecting event handlers int...

Prototype Pollution

Overview org.webjars.npm:linkifyjs is a Find URLs, email addresses, hashtags and @mentions in plain-text strings, then convert them into HTML links. Affected versions of this package are vulnerable to Prototype Pollution via the internal assign helper due to improper filtering of the proto...

UBUNTU-CVE-2025-38364

In the Linux kernel, the following vulnerability has been resolved: mapletree: fix MASTATEPREALLOC flag in maspreallocate Temporarily clear the preallocation flag when explicitly requesting allocations. Pre-existing allocations are already counted against the request through masnodecountgfp, but...

CVE-2025-38364 maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()

In the Linux kernel, the following vulnerability has been resolved: mapletree: fix MASTATEPREALLOC flag in maspreallocate Temporarily clear the preallocation flag when explicitly requesting allocations. Pre-existing allocations are already counted against the request through masnodecountgfp, but...

CLSA-2025-1753131065 libsoup: Fix of 7 CVEs

CVE-2025-32050: fix overflow in appendparamquoted - CVE-2025-32052: fix heap buffer overflow in soupcontentsniffersniff - CVE-2025-32053: fix heap buffer overflow in snifffeedorhtml - CVE-2025-32907: soup-message-headers: correct merge of ranges - CVE-2025-46420: fix leak in...

CLSA-2025-1753124055 libsoup: Fix of 7 CVEs

CVE-2025-32050: fix overflow in appendparamquoted - CVE-2025-32052: fix heap buffer overflow in soupcontentsniffersniff - CVE-2025-32053: fix heap buffer overflow in snifffeedorhtml - CVE-2025-32907: soup-message-headers: correct merge of ranges - CVE-2025-46420: fix leak in...

CLSA-2025-1753120992 libsoup: Fix of 7 CVEs

CVE-2025-32050: fix overflow in appendparamquoted - CVE-2025-32052: fix heap buffer overflow in soupcontentsniffersniff - CVE-2025-32053: fix heap buffer overflow in snifffeedorhtml - CVE-2025-32907: soup-message-headers: correct merge of ranges - CVE-2025-46420: fix leak in...

OS Command Injection

Overview Affected versions of this package are vulnerable to OS Command Injection via the merge tool. An attacker can execute arbitrary commands by supplying crafted input that is improperly handled during the construction of commands. Remediation Upgrade thor to version 1.4.0 or higher. Referenc...

Origin Validation Error

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Origin Validation Error via the review profile process. An attacker can gain unauthorized access to another...

CVE-2025-7365 Keycloak: phishing attack via email verification step in first login flow

A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider IdP login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email...

DEBIAN-CVE-2025-38344

In the Linux kernel, the following vulnerability has been resolved: ACPICA: fix acpi parse and parseext cache leaks ACPICA commit 8829e70e1360c81e7a5a901b5d4f48330e021ea5 I'm Seunghun Han, and I work for National Security Research Institute of South Korea. I have been doing a research on ACPI and...

UBUNTU-CVE-2025-38344

In the Linux kernel, the following vulnerability has been resolved: ACPICA: fix acpi parse and parseext cache leaks ACPICA commit 8829e70e1360c81e7a5a901b5d4f48330e021ea5 I'm Seunghun Han, and I work for National Security Research Institute of South Korea. I have been doing a research on ACPI and...

Keycloak 访问控制错误漏洞

Keycloak is an open source identity and access management solution from Keycloak Open Source. Keycloak suffers from an access control error vulnerability that stems from a flaw in the account merge function during identity provider login, which could allow an attacker to gain access to a victim's...

UBUNTU-CVE-2025-6713

An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCursors stage in MongoDB Server. This may lead to access to data without further authorisation. This issue affects MongoDB Server MongoDB...

MongoDB Server 安全漏洞

MongoDB Server is the United States MongoDB company's set of open source NoSQL database . The database provides collection-oriented storage , dynamic query , data replication and automatic failover and other functions . A security vulnerability exists in MongoDB Server versions prior to 8.0.7,...