CVE-2025-4435

A flaw was found in CPython's tarfile module. This vulnerability allows unauthorized file extraction via crafted tar archives when TarFile.errorlevel=0, bypassing expected filtering mechanisms. Mitigation Mitigation for this issue is either not available or the currently available options do not...

CVE-2025-5068

Use after free in Blink in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium Mitigation Mitigation for this issue is either not available or the currently available options do not meet...

CVE-2025-4567

The Post Slider and Post Carousel with Post Vertical Scrolling Widget WordPress plugin before 3.2.10 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform...

CVE-2025-4567 Post Slider and Carousel with Widget < 3.2.10 - Admin+ Stored XSS

The Post Slider and Post Carousel with Post Vertical Scrolling Widget WordPress plugin before 3.2.10 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform...

VulnCheck KEV: CVE-2022-31161

Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subprocessexecute function without processing the inputs received from the user in the /app/options.py file. Version 6.1.1.0 contains a patch...

CVE-2024-54028

A flaw was found in the OLE Document DIFAT Parser functionality. This vulnerability allows heap-based memory corruption via a specially crafted malformed file. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security...

CVE-2025-46806

A flaw was found in sslh. This vulnerability allows an application-level denial of service via an out-of-range pointer offset on certain architectures. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria...

CVE-2025-46807

A flaw was found in sslh. This vulnerability allows an application-level denial of service by exhausting file descriptors via unrestricted connection attempts without limits or throttling. Mitigation Mitigation for this issue is either not available or the currently available options do not meet...

CVE-2025-49112

A flaw was found in valkey. An integer underflow in the setDeferredReply function of networking.c allows an adjacent network attacker to potentially trigger unexpected behavior. This underflow occurs when calculating prev-size - prev-used, leading to a condition that may result in a denial of...

CVE-2025-29785

A flaw was found in quic-go. This vulnerability allows a malicious QUIC client to cause a nil-pointer dereference, leading to an application-level denial of service via specially crafted ACK packets following spoofed path validation probes. Mitigation Mitigation for this issue is either not...

CVE-2025-40908

A flaw was found in yaml-libyaml. The component uses a two-argument open function when parsing YAML files, which allows an attacker to modify existing files on the system. This flaw allows a local attacker to provide a crafted YAML file as input. This issue can result in unauthorized modification...

Vulnerability of the Server:Options component of the Oracle MySQL Server database management system and the Cluster:General component of the MySQL Cluster database management system, which allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Server:Options component of the Oracle MySQL Server database management system and the Cluster:General component of the MySQL Cluster database management system is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can...

CVE-2025-48942

A denial of service flaw was found in vLLM. This flaw allows a remote attacker with access to the /v1/completions endpoint to submit an invalid jsonschema as a guided param, which will crash the vLLM instance. Mitigation Mitigation for this issue is either not available or the currently available...

CVE-2025-48944

A denial of service flaw was found in vLLM. This flaw allows a remote attacker with access to /v1/chat/completions OpenAPI endpoint to submit malformed data in the "pattern" and "type" fields to crash the vLLM instance. Mitigation Mitigation for this issue is either not available or the currently...

CVE-2025-48943

An application level denial of service flaw was found in vLLM. This flaw allows a remote attacker with access to the system prompt to submit an invalid regular expression while requesting structured output and crash the vLLM instance. Mitigation Mitigation for this issue is either not available o...

CVE-2025-48938

A vulnerability was found in the Browser.Browse functionality of GitHub cli. This flaw allows an attacker who has control of a compromised GitHub Enterprise Server to execute arbitrary commands in the context of the cli user. Mitigation Mitigation for this issue is either not available or the...

CVE-2025-48068

A flaw was found in Next.js. This vulnerability allows limited source code exposure via visiting a malicious webpage while the development server is running with the App Router enabled. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the...

CVE-2025-44904

A flaw was found in the H5VMmemcpyvv function in the HDF5 library. This vulnerability can allow memory corruption and application crashes via reading from a specially crafted compact dataset, leading to a heap-based buffer overflow. Mitigation Mitigation for this issue is either not available or...

CVE-2025-44905

A flaw was found in the HDF5 library, specifically in the H5Zfilterscaleoffset function. This vulnerability allows memory corruption and application crashes via decompression of a malformed HDF5 file using the Scale-Offset filter. The issue arises when the function reads 1 byte beyond a 1-byte he...

OESA-2025-1576 libbpf security update

A mirror of bpf-next linux tree bpf-next/tools/lib/bpf directory plus its supporting header files. The version of the package reflects the version of ABI. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: libbpf: Use OPTSSET macro in bpfxdpquery When the...