netfilter: xt_nfacct: don't assume acct name is null-terminated

...

jfs: fix array-index-out-of-bounds in dbAdjTree

...

ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()

...

jfs: fix array-index-out-of-bounds read in add_missing_indices

...

exfat: fix out-of-bounds access of directory entries

...

mt76: mt7915: fix possible NULL pointer dereference in mt7915_mac_fill_rx_vector

...

firmware: arm_scmi: Fix double free in SMC transport cleanup path

...

smb: client: fix potential UAF in is_valid_oplock_break()

...

Hono's flaw in URL path parsing could cause path confusion

Summary A flaw in the getPath utility function could allow path confusion and potential bypass of proxy-level ACLs e.g. Nginx location blocks. Details The original implementation relied on fixed character offsets when parsing request URLs. Under certain malformed absolute-form Request-URIs, this...

CVE-2025-20328

A vulnerability in the user profile component of Cisco Webex Meetings could have allowed an authenticated, remote attacker with low privileges to conduct a cross-site scripting XSS attack against a user of the web-based interface. Cisco has addressed this vulnerability in the Cisco Webex Meetings...

resource-agents security update

4.9.0-54.16 - bundled requests: fix CVE-2024-47081 Resolves: RHEL-104761 4.9.0-54.15 - ocf-shellfuncs/AWS agents: dont sleep after the final try in curlretry Resolves: RHEL-102731 4.9.0-54.13 - Filesystem: add support for aznfs Resolves: RHEL-91257 4.9.0-54.12 - tomcat: fix CATALINAPID not set, a...

Oracle Linux 9 : python3.9 (ELSA-2025-15019)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-15019 advisory. 3.9.21-2.2 - Security fix for CVE-2025-8194 Resolves: RHEL-106375 Tenable has extracted the preceding description block directly from the Oracle Linux security...

kernel: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too

In the Linux kernel, the following vulnerability has been resolved: netsched: hfsc: Fix a potential UAF in hfscdequeue too Similarly to the previous patch, we need to safe guard hfscdequeue too. But for this one, we don't have a reliable reproducer...

Important: Red Hat Security Advisory: udisks2 security update

An update for udisks2 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

OPENSUSE-SU-2025:15512-1 bpftop-0.7.1-1.1 on GA media

These are all security issues fixed in the bpftop-0.7.1-1.1 package on the GA media of openSUSE Tumbleweed...

Important: postgresql:13 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL executes arbitrary code in restore operation CVE-2025-8715 postgresql: PostgreSQL code execution in restore operation CVE-2025-8714 For more details about the security issues,...

Moderate: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: RDMA/iwcm: Fix use-after-free of work objects after cmid destruction CVE-2025-38211 kernel: tipc: Fix use-after-free in...

ALSA-2025:15010 Moderate: python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

CVE-2025-30273

An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory. We have already fixed the vulnerability in the following versions: QTS 5.2.5.314...

CVE-2025-29887

A command injection vulnerability has been reported to affect QuRouter 2.5.1. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuRouter 2.5.1.060 and later...