SUSE-SU-2025:1059-1 Security update for the Linux Kernel RT (Live Patch 2 for SLE 15 SP6)

This update for the Linux Kernel 6.4.0-150600108 fixes one issue. The following security issue was fixed: - CVE-2024-57882: mptcp: fix TCP options overflow. bsc1235916...

Security update for the Linux Kernel RT (Live Patch 0 for SLE 15 SP6)

This update for the Linux Kernel 6.4.0-1506008 fixes several issues. The following security issues were fixed: CVE-2024-57882: mptcp: fix TCP options overflow. bsc1235916. CVE-2024-41062: Sync sock recv cb and release bsc1228578. Patch Instructions: To install this SUSE update use the SUSE...

CVE-2025-30211 KEX init error results with excessive memory usage

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names 64 characters provided in K...

CVE-2025-30211 KEX init error results with excessive memory usage

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names 64 characters provided in K...

CVE-2025-30371 Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint

Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potential...

CVE-2025-2815 Administrator Z <= 2025.03.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

The Administrator Z plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the adminzimportbackup function in all versions up to, and including, 2025.03.24. This makes it possible for authenticated...

CVE-2025-1860

Data::Entropy for Perl 0.007 and earlier use the rand function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

Malicious code in resolver-options (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68b3b87faef2aa88da0714f9641eef9b258d050775eb10ec9fac90abbae5d8b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress plugin Administrator Z 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exis...

GHSA-RCW3-WMX7-CPHR Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter

Impact In vega 5.30.0 and lower, vega-functions 5.15.0 and lower , it was possible to call JavaScript functions from the Vega expression language that were not meant to be supported. Patches Patched in vega 5.31.0 / vega-functions 5.16.0 Workarounds Is there a way for users to fix or remediate th...

The vulnerability of the Linux operating system’s Bluetooth kernel component, which allows a hacker to trigger a service failure

The vulnerability of the rfcommsocksetsockoptold and rfcommsocksetsockopt functions of the Linux kernel’s Bluetooth component is related to read-off-bounds errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2025-27835

A flaw was found in Artifex Ghostscript. A buffer overflow occurs when converting glyphs to Unicode in psi/zbfont.c. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and...

WordPress BWL Advanced FAQ Manager plugin <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update vulnerability

Missing Authorization to Authenticated Subscriber+ Limited Arbitrary Options Update vulnerability discovered by Lucio Sá in WordPress Plugin BWL Advanced FAQ Manager versions = 2.1.4...

CVE-2025-2754

A flaw was found in the Open Asset Import Library Assimp. The Assimp::AC3DImporter::ConvertObjectSection function of the code/AssetLib/AC/ACLoader.cpp file in the AC3D File Handler component is affected. This attack can be launched remotely, and manipulation of the argument can lead to a heap-bas...

CVE-2025-2756

A flaw was found in the Open Asset Import Library Assimp. This affects the Assimp::AC3DImporter::ConvertObjectSection function of the code/AssetLib/AC/ACLoader.cpp file in the AC3D File Handler component. The manipulation of the tmp argument can lead to a heap-based buffer overflow. It is possibl...

CVE-2025-2753

A flaw was found in the Open Asset Import Library Assimp. The SceneCombiner::MergeScenes function of the code/AssetLib/LWS/LWSLoader.cpp file in the LWS File Handler component is affected. It is possible to launch the attack remotely, and manipulation can lead to out-of-bounds read. Mitigation...

CVE-2025-2724

A flaw was found in the libgsf package, affecting the sortingkeycopy function. It is possible to launch the attack on the local host, and manipulation of the Name argument can lead to out-of-bounds read. Mitigation Mitigation for this issue is either not available or the currently available optio...

CVE-2025-2723

A flaw was found in the GNOME libgsf package, affecting the gsfpropertysettingscollec function. Manipulation of the nallocedparams argument can lead to a heap-based buffer overflow. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red...

Missing Encryption of Sensitive Data

Overview Affected versions of this package are vulnerable to Missing Encryption of Sensitive Data due to the use of insecure Shiro options secureCookies=False and httpOnly=False. An attacker in a MitM position can access sensitive information in transit. Remediation There is no fixed version for...

Missing Encryption of Sensitive Data

Overview Affected versions of this package are vulnerable to Missing Encryption of Sensitive Data due to the use of insecure Shiro options secureCookies=False and httpOnly=False. An attacker in a MitM position can access sensitive information in transit. Remediation There is no fixed version for...