firefox: thunderbird: Privilege escalation in the DOM: Notifications component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Notifications component...

firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript Engine: JIT component...

drm/vgem-fence: Fix potential deadlock on release

...

SUSE CVE-2025-68757

In the Linux kernel, the following vulnerability has been resolved: drm/vgem-fence: Fix potential deadlock on release A timer that expires a vgem fence automatically in 10 seconds is now released with timerdeletesync from fence-ops.release called on last dmafenceput. In some scenarios, it can run...

SUSE CVE-2025-68938

Gitea before 1.25.2 mishandles authorization for deletion of releases...

poppler security update

21.01.0-23 - Bump release for build inheritance - Resolves: RHEL-131792 21.01.0-22 - Check bitmap in combine - Resolves: RHEL-131795, RHEL-131792...

MediaTek chipsets 安全漏洞

MediaTek Chipsets is a line of chipsets from China's MediaTek Corporation MediaTek. A security vulnerability exists in MediaTek chipsets that stems from memory corruption due to reuse after release, which could lead to local elevation of privilege...

MediaTek chipsets 安全漏洞

MediaTek Chipsets is a line of chipsets from China's MediaTek Corporation MediaTek. A security vulnerability exists in MediaTek chipsets that stems from memory corruption due to reuse after release, which could lead to local elevation of privilege...

MediaTek Chipsets 安全漏洞

MediaTek Chipsets is a line of chipsets from China's MediaTek Corporation MediaTek. A security vulnerability exists in MediaTek chipsets that stems from memory corruption due to reuse after release, which could lead to local elevation of privilege...

iccDEV 安全漏洞

iccDEV is a color configuration codebase open-sourced by the International Color Consortium ICC. A security vulnerability exists in iccDEV 2.3.1 and earlier versions, which stems from the presence of post-release reuse in the CIccXform::Create function, which could lead to a post-release reuse...

MediaTek chipsets 安全漏洞

MediaTek Chipsets is a line of chipsets from China's MediaTek Corporation MediaTek. A security vulnerability exists in MediaTek chipsets that stems from a competitive condition resulting in post-release reuse, which could lead to local elevation of privilege...

MediaTek chipsets 安全漏洞

MediaTek Chipsets is a line of chipsets from China's MediaTek Corporation MediaTek. A security vulnerability exists in MediaTek chipsets that stems from memory corruption due to reuse after release, which could lead to local elevation of privilege...

Fedora 42 : gnupg2 (2026-e630ec5c0a)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e630ec5c0a advisory. New upstream release 2.4.9 fixing several vulnerabilities Tenable has extracted the preceding description block directly from the Fedora security...

MediaTek chipsets 安全漏洞

MediaTek Chipsets is a line of chipsets from China's MediaTek Corporation MediaTek. A security vulnerability exists in MediaTek chipsets that stems from memory corruption due to reuse after release, which could lead to local elevation of privilege...

MediaTek chipsets 安全漏洞

MediaTek Chipsets is a line of chipsets from China's MediaTek Corporation MediaTek. A security vulnerability exists in MediaTek chipsets that stems from memory corruption due to reuse after release, which could lead to local elevation of privilege...

MediaTek Chipsets 资源管理错误漏洞

MediaTek Chipsets is a family of chipsets from China's MediaTek Corporation MediaTek. A resource management error vulnerability exists in MediaTek chipsets that stems from memory corruption due to reuse after release, which could lead to local elevation of privilege...

CVE-2025-68437 Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, the Craft CMS GraphQL saveAsset mutation is vulnerable to Server-Side Request Forgery SSRF. This vulnerability arises because the file input, specifically its url parameter,...

CVE-2025-64419

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in commands. If a victim user creates an application from an attacker repository using build...

CVE-2025-59955

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.8 have an information disclosure vulnerability in the /api/v1/teams/teamid/members and /api/v1/teams/current/members API endpoints allows...

CVE-2025-59158 Coolify has Stored XSS in Project Name

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting XSS attack in the project creation workflow. An authenticated user with low privileges e.g....