Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993047)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993047 advisory. In the Linux kernel, the following vulnerability has been resolved: arm64: efi: Make efirtlock a rawspinlock Running a rt-kernel base on 6.2.0-rc3-rt1 on an Ampere...

CVE-2025-64699

The electronic charting system SevenCs ORCA G2 version 2.0.1.35 (EC2007 Kernel v5.22) is vulnerable to an incorrect NULL DACL issue. The regService process, which runs with SYSTEM privileges , applies a Security Descriptor to a device object without an explicitly configured DACL. This flaw could ...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992832)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992832 advisory. In the Linux kernel, the following vulnerability has been resolved: HID: hidraw: fix memory leak in hidrawrelease Free the buffered reports before deleting the list...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992596)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992596 advisory. In the Linux kernel, the following vulnerability has been resolved: PM: hibernate: defer device probing when resuming from hibernation syzbot is reporting hung task ...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992460)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992460 advisory. In the Linux kernel, the following vulnerability has been resolved: arm64: efi: Make efirtlock a rawspinlock Running a rt-kernel base on 6.2.0-rc3-rt1 on an Ampere...

phpMyFAQ has Stored XSS in user list via admin-managed display_name

Summary A stored cross-site scripting XSS vulnerability allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose display name contains HTML entities e.g., img .... When an administrator views the admin user list, the payload is decoded server-si...

CVE-2025-68951

CVE-2025-68951 affects phpMyFAQ. Versions 4.0.14 and 4.0.15 contain a stored XSS vulnerability where an attacker’s HTML entities in a display_name are decoded server-side and rendered unescaped in the admin user list (Twig |raw), enabling script execution in an administrator’s context. A patch ex...

PT-2025-54711

Summary A stored cross-site scripting XSS vulnerability allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose display name contains HTML entities e.g., img .... When an administrator views the admin user list, the payload is decoded server-si...

Evolving Spring Vault: Introducing VaultClient

Back in September 2016, nearly a decade ago now, we introduced Spring Vault as a integration layer for HashiCorp Vault within Spring applications, complemented by Spring Cloud Vault for Spring Boot arrangements. The core idea has always been straightforward: Externalizing secrets to encrypted Vau...

CVE-2022-50709

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid uninit memory read in ath9khtcrxmsg syzbot is reporting uninit value at ath9khtcrxmsg 1, for ioctlUSBRAWIOCTLEPWRITE can call ath9khifusbrxstream with pktlen = 0 but ath9khifusbrxstream uses devallocskbpktlen +...

CVE-2022-50706

In the Linux kernel, the following vulnerability has been resolved: net/ieee802154: don't warn zero-sized rawsendmsg syzbot is hitting skbassertlen warning at devqueuexmit 1, for PFIEEE802154 socket's zero-sized rawsendmsg request is hitting devqueuexmit with skb-len == 0. Since PFIEEE802154...

SUSE CVE-2022-50709

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid uninit memory read in ath9khtcrxmsg syzbot is reporting uninit value at ath9khtcrxmsg 1, for ioctlUSBRAWIOCTLEPWRITE can call ath9khifusbrxstream with pktlen = 0 but ath9khifusbrxstream uses devallocskbpktlen +...

SUSE CVE-2022-50771

In the Linux kernel, the following vulnerability has been resolved: rcu: Fix thiscpuread lockdep warning in rcuforcequiescentstate Running rcutorture with non-zero fqsduration module parameter in a kernel built with CONFIGPREEMPTION=y results in the following splat: BUG: using thiscpuread in...

Linux Distros Unpatched Vulnerability : CVE-2022-50771

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rcu: Fix thiscpuread lockdep warning in rcuforcequiescentstate Running rcutorture with non-zero fqsduration module parameter in a kernel built with...

kimageformats:kimgio_raw_fuzzer: Use-of-uninitialized-value in LibRaw::getbithuff

Detailed Report: https://oss-fuzz.com/testcase?key=6294353053286400 Project: kimageformats Fuzzing Engine: libFuzzer Fuzz Target: kimgiorawfuzzer Job Type: libfuzzermsankimageformats Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: LibRaw::getbithuff...

EUVD-2023-60258

In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to call f2fswaitonpagewriteback in f2fswriterawpages BUGON will be triggered when writing files concurrently, because the same page is writtenback multiple times. 1597 void folioendwritebackstruct folio folio...

CVE-2023-54068

In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to call f2fswaitonpagewriteback in f2fswriterawpages BUGON will be triggered when writing files concurrently, because the same page is writtenback multiple times. 1597 void folioendwritebackstruct folio folio...

UBUNTU-CVE-2022-50771

In the Linux kernel, the following vulnerability has been resolved: rcu: Fix thiscpuread lockdep warning in rcuforcequiescentstate Running rcutorture with non-zero fqsduration module parameter in a kernel built with CONFIGPREEMPTION=y results in the following splat: BUG: using thiscpuread in...

CVE-2022-50771

The CVE-2022-50771 entry describes a Linux kernel fix where rcu_force_quiescent_state() used __this_cpu_read() in preemptible code, incorrectly triggering a lockdep warning during rcutorture with CONFIG_PREEMPTION=y. The patch replaces __this_cpu_read() with raw_cpu_read() to correct the preempti...

CVE-2022-50771 rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state()

In the Linux kernel, the following vulnerability has been resolved: rcu: Fix thiscpuread lockdep warning in rcuforcequiescentstate Running rcutorture with non-zero fqsduration module parameter in a kernel built with CONFIGPREEMPTION=y results in the following splat: BUG: using thiscpuread in...