CVE-2025-51480

A path traversal flaw was found in the ONNX machine learning library. This flaw allows an attacker to overwrite arbitrary files in the scope of the affected program using the library. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the R...

CVE-2025-49656

Users with administrator access can create databases files outside the files area of the Fuseki server. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which fixes the issue. Mitigation Mitigation for this issue is either not available or the...

CVE-2025-54314

A flaw was found in Thor, where it improperly constructs shell commands using data derived from libraries. This flaw allows a local attacker to execute arbitrary commands. Command execution occurs when processing specially crafted library input. Mitigation Mitigation for this issue is either not...

CVE-2025-48965

A flaw was found in mbedtls. The mbedtlsasn1storenameddata function experiences a NULL pointer dereference when val.p is NULL while val.len is greater than zero, leading to a potential crash. This flaw allows a network-based attacker to trigger this condition, resulting in a denial of service...

CVE-2025-54310

A local file access flaw has been discovered in qBittorrent. This flaw may allow access to local files when a web page should be expected. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising...

CVE-2025-53901

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder. The specific bug is triggered by calling pathopen after calling...

CVE-2025-53964

A flaw was found in GoldenDict. The application allows reading and modification of arbitrary files when a user adds a specially crafted dictionary and subsequently performs a search. This vulnerability allows a network attacker with user interaction to potentially manipulate files on the system...

CVE-2025-53817

7-Zip is a file archiver with a high compression ratio. 7-Zip supports extracting from Compound Documents. Prior to version 25.0.0, a null pointer dereference in the Compound handler may lead to denial of service. Version 25.0.0 contains a fix cor the issue. Mitigation Mitigation for this issue i...

CVE-2025-40924

A session id generation flaw has been discovered in the Catalyst::Plugin::Session Perl module. The session id is generated from a hash usually SHA-1 of a simple counter, the epoch time, the built-in rand function, the PID, and the current Catalyst context. This information is of low entropy. The...

CVE-2025-27465

A flaw was found in Xen. Xen’s emulation of intercepted instructions uses replay mechanisms with executable stubs. Improper handling of exceptions raised during this replay process allows a local attacker to trigger unexpected behavior. This issue can occur when an instruction causes an exception...

CVE-2025-40919

Authen::DigestMD5 versions 0.01 through 0.02 for Perl generate the cnonce insecurely. The cnonce client nonce is generated from an MD5 hash of the PID, the epoch time and the built-in rand function. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not...

CVE-2025-40923

A random session id generation flaw has been discovered in Plack-Middleware-Session. By default, session ids are generated by a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed if it is...

CVE-2025-50098

A denial of service flaw was found in MySQL. This flaw allows a privileged attacker with network access via multiple protocols to cause a crash in the MySQL server...

CVE-2025-50096

A denial of service flaw was found in MySQL. This flaw allows a privileged attacker with log-on access to the infrastructure where MySQL Server runs to cause a crash in the MySQL server...

CVE-2025-53906

A path traversal flaw was found in Vim. Successful exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. Mitigation Mitigation for this issue is either not available or the currentl...

CVE-2025-53905

A path traversal flaw was found in Vim. Successful exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. Mitigation Mitigation for this issue is either not available or the currentl...

CVE-2025-7657

Use after free in WebRTC in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High Mitigation Mitigation for this issue is either not available or the currently available options do not meet...

CVE-2025-6965

A memory corruption flaw was found in SQLite. Under specific conditions a query can be generated where the number of aggregate terms could exceed the number of columns available. This issue could lead to memory corruption and subsequent unintended behavior. Mitigation Mitigation for this issue is...

CVE-2025-53643

A request smuggling flaw was found in the aiohttp python library. If a pure Python version of aiohttp is installed, without the usual C extensions, for example, or if AIOHTTPNOEXTENSIONS is enabled, an attacker can execute a request smuggling attack to bypass certain firewalls or proxy protection...

CVE-2025-53014

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the InterpretImageFilename function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processi...