SUSE SLES15: apache2 / apache2-devel / apache2-event / apache2-manual / etc (SUSE-SU-2026:0020-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0020-1 advisory. - CVE-2025-55753: Fixed modmd ACME unintended retry intervals bsc1254511 - CVE-2025-65082: Fixed CGI environment...

SUSE-SU-2026:0020-1 Security update for apache2

This update for apache2 fixes the following issues: - CVE-2025-55753: Fixed modmd ACME unintended retry intervals bsc1254511 - CVE-2025-65082: Fixed CGI environment variable override bsc1254514 - CVE-2025-58098: Fixed Server Side Includes adding query string to exec cmd=... bsc1254512 -...

SUSE-SU-2026:0019-1 Security update for apache2

This update for apache2 fixes the following issues: - CVE-2025-55753: Fixed modmd ACME unintended retry intervals bsc1254511 - CVE-2025-65082: Fixed CGI environment variable override bsc1254514 - CVE-2025-58098: Fixed Server Side Includes adding query string to exec cmd=... bsc1254512 -...

Important: Red Hat Security Advisory: mod_md security update

An update for modmd is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals

An integer overflow flaw has been discovered in the Apache HTTP server. The integer overflow in the case of failed ACME certificate renewal leads, after a number of failures 30 days in default configurations, to the backoff timer becoming 0. Attempts to renew the certificate then are repeated...

RHEL 9 : mod_md (RHSA-2026:0030)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:0030 advisory. This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate...

RHEL 8 : httpd:2.4 (RHSA-2026:0012)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0012 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: modmd: Apache HTTP...

RHEL 9 : mod_md (RHSA-2026:0029)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:0029 advisory. This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate...

EUVD-2023-60373

In the Linux kernel, the following vulnerability has been resolved: debugobjects: Don't wake up kswapd from fillpool syzbot is reporting a lockdep warning in fillpool because the allocation from debugobjects is using GFPATOMIC, which is GFPHIGH | GFPKSWAPDRECLAIM and therefore tries to wake up...

CVE-2023-54268

The CVE-2023-54268 entry concerns a Linux kernel fix for debugobjects: avoid waking kswapd from fill_pool() when GFP_ATOMIC allocations trigger kswapd_wait::lock. The root cause is using GFP_ATOMIC (effectively GFP_HIGH | GFP_KSWAPD_RECLAIM), which can wake up kswapd during fill_pool() as it may ...

CVE-2023-54268 debugobjects: Don't wake up kswapd from fill_pool()

In the Linux kernel, the following vulnerability has been resolved: debugobjects: Don't wake up kswapd from fillpool syzbot is reporting a lockdep warning in fillpool because the allocation from debugobjects is using GFPATOMIC, which is GFPHIGH | GFPKSWAPDRECLAIM and therefore tries to wake up...

CVE-2023-54268 debugobjects: Don't wake up kswapd from fill_pool()

In the Linux kernel, the following vulnerability has been resolved: debugobjects: Don't wake up kswapd from fillpool syzbot is reporting a lockdep warning in fillpool because the allocation from debugobjects is using GFPATOMIC, which is GFPHIGH | GFPKSWAPDRECLAIM and therefore tries to wake up...

PT-2025-54097

In the Linux kernel, the following vulnerability has been resolved: debugobjects: Don't wake up kswapd from fill pool syzbot is reporting a lockdep warning in fill pool because the allocation from debugobjects is using GFP ATOMIC, which is GFP HIGH | GFP KSWAPD RECLAIM and therefore tries to wake...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992456)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992456 advisory. In the Linux kernel, the following vulnerability has been resolved: pagepool: avoid infinite loop to schedule delayed worker We noticed the kworker in...

CVE-2025-68148

FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on given instance, making it unusable for majority of users. This issue has been patched in...

PT-2025-53840

Name of the Vulnerable Software and Affected Versions Framelink Figma MCP Server affected versions not specified Description This issue allows remote attackers to execute arbitrary code on affected installations of Framelink Figma MCP Server without requiring authentication. The flaw resides with...

Framelink Figma MCP Server fetchWithRetry Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Framelink Figma MCP Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the fetchWithRetry method. The issue results from the...

FreshRSS 安全漏洞

FreshRSS is a free, self-hosted RSS aggregator from FreshRSS Open Source. A security vulnerability exists in FreshRSS version 1.27.0 through versions prior to 1.28.0, which stems from an attacker being able to modify the proxy settings to cause a 429 Retry-After response, which could result in a...

CVE-2025-68148 FreshRSS globally denies access to feed via proxy modifying to 429 Retry-After

FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on given instance, making it unusable for majority of users. This issue has been patched in...

CVE-2025-68148

The CVE-2025-68148 issue affects FreshRSS versions 1.27.0 through before 1.28.0. An attacker could globally deny access to feeds by manipulating proxy settings to generate a flood of 429 Retry-After responses, effectively making the instance unusable for most users. The vulnerability is addressed...