CVE-2025-26594

A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free. Mitigation Mitigation for this issue is either not available or...

Hitachi Energy Service Suite

SUMMARY Hitachi Energy is aware of the multiple vulnerabilities related to open-source Apache Tomcat components that affect the Service Suite product versions listed in this document. An attacker successfully exploiting these vulnerabilities can cause confidentiality, integrity and availability...

GHSA-R9XF-MWCP-F4X8 vulnerabilities

Vulnerabilities for packages: mysql...

GHSA-C9VC-XGH4-QH78 vulnerabilities

Vulnerabilities for packages: mysql...

GHSA-GGMG-XF9G-8CJX vulnerabilities

Vulnerabilities for packages: mysql...

CVE-2025-27144

A flaw was found in GO-JOSE. In affected versions, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code uses strings.Splittoken, "." to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large numb...

CVE-2025-1634

A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError. Mitigation...

Siemens SCALANCE W700 Externally Controlled Reference to a Resource in Another Sphere (CVE-2023-0045)

The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ibprctlset function updates the Thread Information Flags TIFs for the task and updates the SPECCTRL MSR on the function speculationctrlupdate, but the IBPB is only issued on the next schedul...

CVE-2025-24989

An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update...

Exploit for OS Command Injection in Wago Compact_Controller_100_Firmware

wagoexploit.py - PoC Exploit for CVE-2023-1698 !WAGOhttp...

PT-2025-7443 · Unknown · Java Sdk For Cloudevents

Name of the Vulnerable Software and Affected Versions: Java SDK for CloudEvents version 4.0.1 Description: The issue is related to an XML External Entity XXE vulnerability in the deserializeArgs method. This allows attackers to access sensitive information by supplying a crafted XML-formatted eve...

Python 3.12 Documentation Cross Site Scripting

The official Python 3.12 documentation provides a code example that results in implementing insecure code susceptible to cross site scripting. Python's official documentation contains textbook example of insecure code XSS Date: 2025-02-18 Author: Georgi Guninski From the official Python 3.12...

Remote Code Execution Vulnerability in XWiki Platform (CVE-2025-24893)

This module exploits a template injection vulnerability in the the XWiki Platform. XWiki includes a macro called SolrSearch defined in Main.SolrSearchMacros that enables full-text search through the embedded Solr engine. The vulnerability stems from the way this macro evaluates search parameters ...

CVE-2025-24989

An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update...

EUVD-2025-4642

An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update...

CVE-2025-0633

A flaw was found in iniparser. This vulnerability allows an attacker to read out-of-bound memory via iniparserdumpsectionini. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use an...

CVE-2025-22920

A flaw was found in FFmpeg. This vulnerability allows attackers to trigger memory corruption via supplying a crafted media file in avformat when processing tile grid group streams, leading to a Denial of Service DoS. Mitigation Mitigation for this issue is either not available or the currently...

CVE-2025-25473

FFmpeg git master before commit c08d30 was discovered to contain a NULL pointer dereference via the component libavformat/mov.c. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use...

CVE-2025-22919

A flaw was found in FFmpeg. This vulnerability allows attackers to cause a Denial of Service DoS via opening a crafted AAC file. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use...

CVE-2025-25468

A flaw was found in FFmpeg. This vulnerability allows an attacker to exhaust memory resources, which can lead to a denial of service via improper memory management. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...