CVE-2025-59777

NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service DoS...

CVE-2025-47908

A flaw was found in github.com/rs/cors. The middleware exhibits excessive heap memory allocation when handling preflight requests containing a lengthy, comma-separated value in the Access-Control-Request-Headers ACRH header. This vulnerability allows an attacker to send a specially crafted HTTP...

CVE-2025-45764

A flaw was found in jsrsasign. The library uses weak encryption algorithms, potentially resulting in sensitive data being vulnerable to decryption by an attacker with local access. This weakness allows a malicious actor to compromise confidentiality without requiring authentication or user...

CVE-2024-8244

The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU time of check/time of use race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress...

CVE-2025-54571

A flaw was found in modsecurity. The engine may allow attackers to manipulate the HTTP response’s Content-Type header, enabling them to influence downstream processes or applications. This manipulation can be achieved remotely without authentication. Consequently, an attacker can alter the expect...

CVE-2025-54801

A flaw was found in github.com/gofiber/fiber/v2. The Ctx.BodyParser function fails to properly validate numeric form keys, allowing a large integer value to be interpreted as a slice index. This flaw allows a remote attacker to trigger this condition by submitting a crafted form with a sufficient...

CVE-2025-54874

An out-of-bounds heap memory write OOB flaw was found in OpenJPEG. A call to opjjp2readheader may lead to an OOB heap memory write when the data stream pstream is too short and pimage is not initialized. Mitigation Mitigation for this issue is either not available or the currently available optio...

CVE-2025-54410

A firewall state management issue was found in the Moby project. When firewalld reloads, Docker fails to recreate iptables rules that isolate bridge networks, allowing any container to access all ports on any other container across different bridge networks on the same host. This issue breaks...

CVE-2025-8101

A prototype pollution vulnerability was found in Linkify. This vulnerability allows an attacker to inject HTML attributes and manipulate user-controlled variables. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

CVE-2025-38439

In the Linux kernel, the following vulnerability has been resolved: bnxten: Set DMA unmap len correctly for XDPREDIRECT When transmitting an XDPREDIRECT packet, call dmaunmaplenset with the proper length instead of 0. This bug triggers this warning on a system with IOMMU enabled: WARNING: CPU: 36...

CVE-2025-54566

A flaw was found in QEMU. A migration state inconsistency within the pciesriov emulation code allows an attacker with adjacent network access to trigger unexpected behavior. This condition arises from a state mismatch during migration processes, which can potentially lead to resource exhaustion...

CVE-2025-8010

A type confusion flaw was found in the Chromium web browser. This flaw allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security...

CVE-2025-48964

An integer overflow flaw has been discovered in the ping function within the iputils package. This overflow may allow an attacker to craft an ECHO reply which can prevent iputils from operating normally. Mitigation Mitigation for this issue is either not available or the currently available optio...

CVE-2025-7962

A flaw was found in com.sun.mail/jakarta.mail. The jakarta.mail component allows an attacker to inject SMTP messages by exploiting improper handling of carriage return and newline characters encoded in UTF-8. An unauthenticated attacker can leverage this vulnerability to send arbitrary SMTP...

CVE-2025-54121

A denial of service flaw was found in the Starlette ASGI framework. This flaw allows a remote attacker to submit a specially crafted multi-part form with large files. This can exhaust the server's resources, which may block the main thread pool and lead to a denial of service. Mitigation Mitigati...

CVE-2025-50151

A file path validation flaw has been discovered in Apache Jena. This flaw allows users with administrative access to upload arbitrary configurations. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria...

CVE-2025-54314

A flaw was found in Thor, where it improperly constructs shell commands using data derived from libraries. This flaw allows a local attacker to execute arbitrary commands. Command execution occurs when processing specially crafted library input. Mitigation Mitigation for this issue is either not...

CVE-2025-48965

A flaw was found in mbedtls. The mbedtlsasn1storenameddata function experiences a NULL pointer dereference when val.p is NULL while val.len is greater than zero, leading to a potential crash. This flaw allows a network-based attacker to trigger this condition, resulting in a denial of service...

CVE-2025-54310

A local file access flaw has been discovered in qBittorrent. This flaw may allow access to local files when a web page should be expected. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising...

CVE-2025-7783

A vulnerability related to predictable random number generation has been discovered in the form-data JavaScript library. The library utilizes Math.random to determine boundary values for multipart form-encoded data. This presents a security risk if an attacker can observe other values generated b...