CVE-2025-61730

The crypto/tls component in the Go programming language is vulnerable to a flaw where TLS 1.3 handshake messages might be processed at an incorrect encryption level . Specifically, if multiple messages are sent in records spanning encryption level boundaries (e.g., Client Hello and Encrypted Exte...

CVE-2025-61730 Handshake messages may be processed at the incorrect encryption level in crypto/tls

During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries for instance the Client Hello and Encrypted Extensions messages, the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosu...

EUVD-2025-206443

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, authenticated users can submit crafted payloads to /drafts.json that cause On^2 processing in Base62.decode, tying up workers for 35-60 seconds per request. This affects all users as t...

CVE-2025-3950 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, gitlab-workhorse-ce...

Incorrect Behavior Order: Early Validation

Overview std/crypto/tls is a Go standard library package std/crypto/tls Affected versions of this package are vulnerable to Incorrect Behavior Order: Early Validation. Go Vulnerability Report: During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the tensor shape process. An attacker can cause the application to crash or become unresponsive by supplying specially crafted tensor shapes. Remediation There is no fixed version for oneflow. References - GitHub...

CVE-2026-22243

CVE-2026-22243 — EGroupware SQL Injection (Nextmatch filter processing) Affected software: EGroupware web-based groupware server (PHP), versions prior to 23.1.20260113 and 26.0.20260113. Root cause and vulnerability: An authenticated SQL Injection exists in the Nextmatch filter processing. The is...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the soupsessionredirectmessage function. Sensitive proxy credentials can be leaked due to improper handling of authorization headers during HTTP redirect processing. Remediation A fix...

kernel: KVM: arm64: Tear down vGIC on failed vCPU creation

A use-after-free flaw was found in KVM for arm64 in the Linux Kernel, if the kvmarchvcpucreate fails to share the vCPU page with the hypervisor. This vulnerability could even lead to a kernel information leak problem...

GHSA-9VJ4-WC7R-P844 vulnerabilities

Vulnerabilities for packages: imagemagick...

openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing

A flaw was found in OpenSSL. This vulnerability allows a remote attacker to trigger a Denial of Service DoS by providing a specially crafted, malformed PKCS12 file to an application that processes it. The flaw occurs due to a NULL pointer dereference in the PKCS12itemdecryptd2iex function when...

openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing

A flaw was found in OpenSSL. When processing a specially crafted PKCS12 Personal Information Exchange Syntax Standard file, a remote attacker can exploit an out-of-bounds write vulnerability. This issue, occurring within the OPENSSLuni2utf8 function, leads to memory corruption by writing data...

CVE-2025-70999

A GPU device-ID validation flaw in the flow.cuda.getdevicecapability component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted device ID...

CVE-2025-65891

A GPU device-ID validation flaw in OneFlow v0.9.0 allows attackers to trigger a Denial of Dervice DoS by invoking flow.cuda.getdeviceproperties with an invalid or negative device index...

EUVD-2025-206472

A GPU device-ID validation flaw in the flow.cuda.getdevicecapability component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted device ID...

CVE-2025-65890

OneFlow version v0.9.0 contains a device-ID validation flaw within the flow.cuda.synchronize() function. This vulnerability allows an attacker to cause a Denial of Service (DoS) by supplying an invalid or out-of-range GPU device index, which can cause the application to crash or become unresponsi...

EUVD-2025-206473

A GPU device-ID validation flaw in OneFlow v0.9.0 allows attackers to trigger a Denial of Dervice DoS by invoking flow.cuda.getdeviceproperties with an invalid or negative device index...

PT-2026-5147

A GPU device-ID validation flaw in OneFlow v0.9.0 allows attackers to trigger a Denial of Dervice DoS by invoking flow.cuda.get device properties with an invalid or negative device index...

ALSA-2026:1472 Important: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS12 file CVE-2025-11187...

CVE-2025-70999

The deep learning framework OneFlow v0.9.0 is vulnerable to a Denial of Service (DoS) attack due to an improper validation of array index within the flow.cuda.get_device_capability() component. An attacker can provide a crafted device ID to cause the application to crash or become unresponsive. T...