PT-2025-47049

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 16.9 through 18.3.5 GitLab CE/EE versions 18.4 through 18.4.3 GitLab CE/EE versions 18.5 through 18.5.1 Description An authenticated attacker could cause a denial of service condition by submitting specially crafted...

PT-2025-49084

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.17.0-rc4+ Description The Linux kernel contains a flaw in the Open vSwitch OVS component related to the handling of Network Service Header NSH fields within the setnsh... action. The validation process for this...

Splunk Enterprise 9.2.0 < 9.2.9, 9.3.0 < 9.3.7, 9.4.0 < 9.4.5, 10.0.0 < 10.0.1 (SVD-2025-1103)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2025-1103 advisory. - jackson-core contains core low-level incremental streaming parser and generator abstractions used by Jackson Data Processor. ...

Stale Translation Lookaside Buffer (TLB) Entry Vulnerability

Summary An internally reported microcode bug in some EPYC™ AMD CPUs could allow a local admin-privileged attacker to run SEV-SNP Secure Encrypted Virtualization - Secure Nested Paging guests using stale TLB entries. This bug could allow SNP active vCPUs to reuse TLB entries from other virtual...

protobuf: StackOverflow vulnerability in Protocol Buffers

A flaw was found in Protocol Buffers protobuf. This issue can allows an attacker to cause a StackOverflow via parsing untrusted Protocol Buffers data containing arbitrarily nested SGROUP tags, leading to unbounded recursion...

protobuf: StackOverflow vulnerability in Protocol Buffers

A flaw was found in Protocol Buffers protobuf. This issue can allows an attacker to cause a StackOverflow via parsing untrusted Protocol Buffers data containing arbitrarily nested SGROUP tags, leading to unbounded recursion...

Prototype Pollution

messageformat is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of nested message keys containing special characters such as proto, which allows an attacker to inject arbitrary properties into the global object prototype, potentially leading to denial of service ...

CVE-2025-12808

Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custom values, resulting in password disclosure. This issue affects the following versions : Devolutions Server 2025.3.2.0 through 2025.3.5.0 Devolutions Server...

CVE-2025-12808

Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custom values, resulting in password disclosure. This issue affects the following versions : Devolutions Server 2025.3.2.0 through 2025.3.5.0 Devolutions Server...

CVE-2025-12808

Devolutions Server is affected by a vulnerability where improper access control allows a View-only user to retrieve sensitive third-level nested fields , such as custom values within password lists. This flaw can lead to password disclosure . The issue impacts Devolutions Server versions 2025.3.2...

Prototype Pollution

@messageformat/runtime is vulnerable to Prototype Pollution. The vulnerability is due to insufficient validation of nested message keys during message data processing, which allows an attacker to inject arbitrary properties into the Object prototype and cause denial of service or unexpected...

PT-2025-45339

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2025.2.15.0 through 2025.3.5.0 Description A flaw in access control allows a View-only user to access sensitive, deeply nested data, specifically custom values within password lists, potentially leading to password...

CVE-2025-12808: Improper Access Control

Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custom values, resulting in password disclosure. This issue affects the following versions : Devolutions Server 2025.3.2.0 through 2025.3.5.0 Devolutions Server...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990564)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990564 advisory. In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix leak of nested actions While parsing user-provided actions, openvswitch...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988997)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988997 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Always make an attempt to map eVMCS after migration When enlightened VMCS is in use an...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989806)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989806 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Forcibly leave nested virt when SMM state is toggled Forcibly leave nested virtualizati...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989144)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989144 advisory. In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix leak of nested actions While parsing user-provided actions, openvswitch...

Unity Linux 20.1050e Security Update: kernel (UTSA-2025-990119)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990119 advisory. In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix leak of nested actions While parsing user-provided actions, openvswitch...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988815)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988815 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ensure liveliness of nested VM-Enter fail tracepoint message Use the string machinery...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: netsched: genestimator: fix esttimer vs CONFIGPREEMPTRT=y The syzbot reported a warning in esttimer 1. The problem arises from the fact that when CONFIGPREEMPTRT=y is enabled, timer callbacks can be preempted...