kernel: padata: fix UAF in padata_reorder

A use-after-free vulnerability was found in the Linux kernel's padata subsystem, in the padatareorder function. Caused by improper synchronization controls, this vulnerability can occur when a reference-counted data structure pd is decremented in one thread, freeing it, while another thread still...

Linux Distros Unpatched Vulnerability : CVE-2021-30470

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in PoDoFo 0.9.7. An uncontrolled recursive call among PdfTokenizer::ReadArray, PdfTokenizer::GetNextVariant and PdfTokenizer::ReadDataType...

Linux Distros Unpatched Vulnerability : CVE-2023-25361

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free vulnerability in WebCore::RenderLayer::setNextSibling in WebKitGTK before 2.36.8 allows attackers to execute code remotely. CVE-2023-25361 Note...

CVE-2025-57822

Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has...

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +1014 more potentially affected by CVE-2025-57752 via next (>=15.0.0, <=15.4.1)

next NPM version =15.0.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =1.5.0-beta.1, =0.1.0, =0.1.0, =0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, =0.0.5-alpha-20250505070314-fe37055a9f31a5579df0224dd5a16cce090d542b and more Source cves: CVE-2025-57752 Source advisory:...

Use of Cache Containing Sensitive Information

Overview next is a react framework. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the image optimization process, when responses from API routes vary based on request headers such as Cookie or Authorization. An attacker can gain unauthorized...

@adenta/cms (>=0.0.6, <=1.1.1-0), @edrlab/thorium-web (>=1.0.0-beta.3, <=1.0.0-beta.8) +18 more potentially affected by CVE-2025-57752 via next (>=15.4.3, <=15.4.4)

next NPM version =15.4.3, =0.0.6, =1.0.0-beta.3, =0.0.1, =0.0.1, =0.1.0, =1.0.0, =0.1.0, =0.0.1, =0.1.0, =1.0.0, =2.1.5, =2.1.21 and more Source cves: CVE-2025-57752 Source advisory: SNYK:JS-NEXT-12301496...

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +1042 more potentially affected by CVE-2025-57752 via next (>=15.0.0, <=15.4.4)

next NPM version =15.0.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =1.5.0-beta.1, =0.1.0, =0.1.0, =0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, =0.0.5-alpha-20250505070314-fe37055a9f31a5579df0224dd5a16cce090d542b and more Source cves: CVE-2025-57752 Source advisory:...

@adenta/cms (>=0.0.6, <=1.1.1-0), @edrlab/thorium-web (>=1.0.0-beta.3, <=1.0.0-beta.8) +18 more potentially affected by CVE-2025-55173 via next (>=15.4.3, <=15.4.4)

next NPM version =15.4.3, =0.0.6, =1.0.0-beta.3, =0.0.1, =0.0.1, =0.1.0, =1.0.0, =0.1.0, =0.0.1, =0.1.0, =1.0.0, =2.1.5, =2.1.21 and more Source cves: CVE-2025-55173 Source advisory: SNYK:JS-NEXT-12265451...

Missing Source Correlation of Multiple Independent Data

Overview next is a react framework. Affected versions of this package are vulnerable to Missing Source Correlation of Multiple Independent Data in image-optimizer. An attacker can cause arbitrary files to be downloaded with attacker-controlled content and filenames by supplying malicious external...

CVE-2025-57822

Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has...

@adenta/cms (>=0.0.6, <=1.1.1-0), @cognizant-ai-lab/ui-common (>=1.2.4-main.7f918ee.29, <=1.3.3) +82 more potentially affected by CVE-2025-57822 via next (>=15.4.3, <=15.4.6)

next NPM version =15.4.3, =0.0.6, =1.2.4-main.7f918ee.29, =1.0.0-beta.3, =1.0.2, =0.0.1, =0.0.1, =1.1.0, =1.0.1, =0.0.1, =0.1.0, =0.1.0, =0.1.1 - @madraka/nextjs-videoplayer 1.0.4 - @misikirayu/nextjs-blog-cms 1.0.0 and more Source cves: CVE-2025-57822 Source advisory: SNYK:JS-NEXT-12299318...

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +1014 more potentially affected by CVE-2025-57822 via next (>=15.0.0, <=15.4.1)

next NPM version =15.0.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =1.5.0-beta.1, =0.1.0, =0.1.0, =0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, =0.0.5-alpha-20250505070314-fe37055a9f31a5579df0224dd5a16cce090d542b and more Source cves: CVE-2025-57822 Source advisory:...

Server-side Request Forgery (SSRF)

Overview next is a react framework. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the resolve-routes. An attacker can access internal resources and potentially exfiltrate sensitive information by crafting requests containing user-controlled headers e.g.,...

PT-2025-35327

Name of the Vulnerable Software and Affected Versions Next.js versions prior to 14.2.31 Next.js versions 15.0.0 through 15.4.5 Description Next.js Image Optimization API routes are susceptible to a cache key confusion issue. When images returned from API routes vary based on request headers, such...

CVE-2025-57822: Server-Side Request Forgery (SSRF)

Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has...

PT-2025-35322

Name of the Vulnerable Software and Affected Versions Next.js versions prior to 14.2.32 and prior to 15.4.7 Description Next.js is a React framework for building full-stack web applications. When the next function was used without explicitly passing the request object in self-hosted applications,...

An Inside Look at our Next Gen Object Storage Launch

...

Linux Distros Unpatched Vulnerability : CVE-2021-40648

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In man2html 1.6g, a filename can be created to overwrite the previous size parameter of the next chunk and the fd, bk, fdnextsize, bknextsize of the current...

SUSE CVE-2024-56703

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix soft lockups in fib6selectpath under high next hop churn Soft lockups have been observed on a cluster of Linux-based edge routers located in a highly dynamic environment. Using the bird service, these routers continuous...