SUSE CVE-2025-48060

jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function jvstringvfmt in the jqfuzzexecute harness from oss-fuzz. This crash happens on file jv.c, line 1456 void p = mallocsz;. As of time of publication, no patched versions are...

OSV-2024-1446 Segv on unknown address in glslang::TIntermediate::addSymbol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=422517700 Crash type: Segv on unknown address Crash state: glslang::TIntermediate::addSymbol glslang::HlslParseContext::handleFunctionCall glslang::HlslParseContext::transformEntryPoint...

OSV-2025-442 Security exception in org.jsoup.parser.HtmlTreeBuilder.process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=422516687 Crash type: Security exception Crash state: org.jsoup.parser.HtmlTreeBuilder.process org.jsoup.parser.HtmlTreeBuilderState$8.process org.jsoup.parser.TreeBuilder.currentElement...

OSV-2025-433 Null-dereference READ in _libssh2_packet_add

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=422217191 Crash type: Null-dereference READ Crash state: libssh2packetadd fullpacket libssh2transportread...

PT-2025-33603 · Git · Graphql-Java

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=422217211 Crash type: Security exception Crash state: graphql.parser.GraphqlAntlrToLanguage.createNonNullType graphql.parser.GraphqlAntlrToLanguage.createType graphql.parser.GraphqlAntlrToLanguage.createListType...

OSV-2025-419 Security exception in org.apache.lucene.util.AttributeImpl.clone

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420955259 Crash type: Security exception Crash state: org.apache.lucene.util.AttributeImpl.clone org.apache.lucene.util.AttributeSource$State.clone org.apache.lucene.util.AttributeSource$State.clone...

PT-2025-25487 · Git +1 · Lucene

Name of the Vulnerable Software and Affected Versions: Apache Lucene affected versions not specified Description: The software experiences a security exception during the cloning process within the org.apache.lucene.util.AttributeImpl and org.apache.lucene.util.AttributeSource$State classes. The...

OSV-2025-412 UNKNOWN WRITE in luaL_newstate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420248727 Crash type: UNKNOWN WRITE Crash state: luaLnewstate...

PT-2025-24333 · Git +1 · Tarantool

Name of the Vulnerable Software and Affected Versions: Lua affected versions not specified Description: The software is susceptible to an unknown write issue triggered during the luaL newstate function call. Recommendations: At the moment, there is no information about a newer version that contai...

OSV-2025-409 Heap-buffer-overflow in libodbc.so.2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420248718 Crash type: Heap-buffer-overflow READ 9 Crash state: libodbc.so.2 libodbc.so.2 libodbc.so.2...

OSV-2025-408 Heap-buffer-overflow in sav_parse_long_variable_names_record

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420198855 Crash type: Heap-buffer-overflow READ 1 Crash state: savparselongvariablenamesrecord savparserecordspass2 readstatparsesav...

OSV-2025-406 Security exception in com.puppycrawl.tools.checkstyle.JavaAstVisitor.getInnerBopAst

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420197344 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.JavaAstVisitor.getInnerBopAst java.base/java.util.stream.ReferencePipeline$3$1.accept...

PT-2025-23994 · Git +1 · Checkstyle

Name of the Vulnerable Software and Affected Versions: Checkstyle affected versions not specified Description: The software experiences a security exception during the getInnerBopAst function within the com.puppycrawl.tools.checkstyle.JavaAstVisitor class. This issue is triggered during stream...

PT-2025-23995 · Git +1 · Readstat

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. affected versions not specified Description: The software contains a heap-buffer-overflow read issue. The crash occurs during the sav parse long variable names record function, which is called by sav par...

CVE-2025-3580

An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint. The vulnerability can be exploited when: 1. An Organization administrator...

CVE-2025-3580

An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint. The vulnerability can be exploited when: 1. An Organization administrator...

CVE-2025-3580

CVE-2025-3580 (Grafana Open Source) : An access-control flaw in the DELETE /api/org/users/ endpoint allows an Organization administrator to permanently delete the Server administrator account. If the sole Server admin is deleted, the Grafana instance becomes unmanageable with no super-user permis...

CVE-2025-3580

An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint. The vulnerability can be exploited when: 1. An Organization administrator...

CVE-2024-29781

In ssAnalyzeOssReturnResUssdArgIe of ssOssAsnManagement.c, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-47609

SQL injection vulnerability in OSS Calendar versions prior to v.2.0.3 allows a remote authenticated attacker to execute arbitrary code or obtain and/or alter the information stored in the database by sending a specially crafted request...