CVE-2025-38439

In the Linux kernel, the following vulnerability has been resolved: bnxten: Set DMA unmap len correctly for XDPREDIRECT When transmitting an XDPREDIRECT packet, call dmaunmaplenset with the proper length instead of 0. This bug triggers this warning on a system with IOMMU enabled: WARNING: CPU: 36...

SUSE-SU-2025:02529-1 Security update for MozillaFirefox, MozillaFirefox-branding-SLE

This update for MozillaFirefox, MozillaFirefox-branding-SLE fixes the following issues: MozillaFirefox is updated to the 140ESR series. Firefox Extended Support Release 140.0esr ESR: General - Reader View now has an enhanced Text and Layout menu with new options for character spacing, word spacin...

CVE-2025-54566

A flaw was found in QEMU. A migration state inconsistency within the pciesriov emulation code allows an attacker with adjacent network access to trigger unexpected behavior. This condition arises from a state mismatch during migration processes, which can potentially lead to resource exhaustion...

CVE-2025-8114

A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange KEX process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash. Mitigation...

Security Bulletin: Erlang/OTP Vulnerability in KEX Init Handling May Lead to High Memory Usage

Summary Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names 64 characters...

Hackers Deploy Stealth Backdoor in WordPress Mu-Plugins to Maintain Admin Access

Cybersecurity researchers have uncovered a new stealthy backdoor concealed within the "mu-plugins" directory in WordPress sites to grant threat actors persistent access and allow them to perform arbitrary actions. Must-use plugins aka mu-plugins are special plugins that are automatically activate...

CVE-2016-15045

A local privilege escalation flaw was found in the deepin-daemon lastore-daemon. This flaw allows the creation of a privileged user when a crafted .deb package with a malicious post-install script is provided. The system must permit the installation of unsigned packages for this flaw to be...

Clickjacking

@haxtheweb/haxcms-nodejs and elmsln/haxcms are vulnerable to Clickjacking. The vulnerability is due to missing anti-framing headers caused by the absence of X-Frame-Options or equivalent headers in both the CMS and generated sites, allowing unauthenticated attackers to embed sensitive pages in...

CVE-2025-8011

A type confusion flaw was found in the Chromium web browser. This flaw allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security...

CVE-2025-53538

Suricata is a network IDS, IPS and NSM engine developed by the OISF Open Information Security Foundation and the Suricata community. In versions 7.0.10 and below and 8.0.0-beta1 through 8.0.0-rc1, mishandling of data on HTTP2 stream 0 can lead to uncontrolled memory usage, leading to loss of...

CVE-2025-51480

A path traversal flaw was found in the ONNX machine learning library. This flaw allows an attacker to overwrite arbitrary files in the scope of the affected program using the library. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the R...

CVE-2025-50151

A file path validation flaw has been discovered in Apache Jena. This flaw allows users with administrative access to upload arbitrary configurations. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria...

CVE-2025-49656

Users with administrator access can create databases files outside the files area of the Fuseki server. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which fixes the issue. Mitigation Mitigation for this issue is either not available or the...

CVE-2025-54314

A flaw was found in Thor, where it improperly constructs shell commands using data derived from libraries. This flaw allows a local attacker to execute arbitrary commands. Command execution occurs when processing specially crafted library input. Mitigation Mitigation for this issue is either not...

CVE-2025-48965

A flaw was found in mbedtls. The mbedtlsasn1storenameddata function experiences a NULL pointer dereference when val.p is NULL while val.len is greater than zero, leading to a potential crash. This flaw allows a network-based attacker to trigger this condition, resulting in a denial of service...

Exploit for CVE-2025-34085

CVE-2025-34085 — WordPress Simple File List Unauthenticated RC...

Fedora 41 : screen (2025-653690f2f7)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-653690f2f7 advisory. Update default config options for build. ---- New upstream release 5.0.1 Tenable has extracted the preceding description block directly from the...

Fedora 42 : screen (2025-f055a0d751)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-f055a0d751 advisory. Update default config options for build. ---- New upstream release 5.0.1 Tenable has extracted the preceding description block directly from the...

CVE-2025-54310

A local file access flaw has been discovered in qBittorrent. This flaw may allow access to local files when a web page should be expected. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising...

CVE-2025-53901

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder. The specific bug is triggered by calling pathopen after calling...