CVE-2025-38108

CVE-2025-38108 affects the Linux kernel’s network scheduler, specifically the RED qdisc. The issue is a race in __red_change() where the SFQ perturb timer can fire at an inopportune time, allowing an underflow of a parent qlen during a concurrent qdisc_tree_flush/backlog sequence. The race scenar...

CVE-2025-38106

Mode C: Concrete details found. The CVE-2025-38106 issue is in the Linux kernel io_uring/sqpoll path, where a use-after-free of sq->thread could occur when __io_uring_show_fdinfo() uses a freed task_struct. The SUSE/OpenSUSE advisory notes the fix: assign and look up sq->thread under RCU wi...

PT-2025-27805 · WordPress · Wpvivid Backup/Migration

Name of the Vulnerable Software and Affected Versions: Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress versions up to, and including, 0.9.116 Description: The issue is related to arbitrary file uploads due to missing file type validation in the wpvivid upload import...

OPENSUSE-SU-2025:15297-1 libspdlog1_15-1.15.3-2.1 on GA media

These are all security issues fixed in the libspdlog115-1.15.3-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15282-1 python311-rfc3161-client-1.0.3-1.1 on GA media

These are all security issues fixed in the python311-rfc3161-client-1.0.3-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15235-1 kubernetes1.31-apiserver-1.31.10-1.1 on GA media

These are all security issues fixed in the kubernetes1.31-apiserver-1.31.10-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15308-1 libwireshark18-4.4.7-1.1 on GA media

These are all security issues fixed in the libwireshark18-4.4.7-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2025-27736 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved. The issue is related to the af packet module, where calling PACKET ADD MEMBERSHIP on an ops-locked device can trigger the NETDEV...

OPENSUSE-SU-2025:15210-1 chromedriver-138.0.7204.96-1.1 on GA media

These are all security issues fixed in the chromedriver-138.0.7204.96-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15241-1 libsoup-3_0-0-3.6.5-6.1 on GA media

These are all security issues fixed in the libsoup-30-0-3.6.5-6.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15281-1 python311-requests-2.32.4-1.1 on GA media

These are all security issues fixed in the python311-requests-2.32.4-1.1 package on the GA media of openSUSE Tumbleweed...

Updated rootcerts, nss & firefox packages fix security vulnerabilities

CVE-2025-6424: A use-after-free in FontFaceSet resulted in a potentially exploitable crash. CVE-2025-6425: An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private...

CVE-2025-52559 Zulip XSS in digest preview URL

Zulip is an open-source team chat application. From versions 2.0.0-rc1 to before 10.4 in Zulip Server, the /digest/ URL of a server shows a preview of what the email weekly digest would contain. This URL, though not the digest itself, contains a cross-site scripting XSS vulnerability in both topi...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free via std::atomicint in reference counting process. An attacker can execute arbitrary code or cause a denial of service by overflowing the reference count and triggering access to memory after it has been freed. Remediation...

CVE-2025-38092

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use listfirstentryornull for opinfogetlist The listfirstentry macro never returns NULL. If the list is empty then it returns an invalid pointer. Use listfirstentryornull to check if the list is empty...

RHEL 9 : thunderbird (RHSA-2025:10196)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:10196 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: Unsolicited File Download, Disk Space Exhaustio...

Slackware: Security Advisory (SSA:2025-182-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 7 : glibc (RHSA-2025:10219)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10219 advisory. The glibc packages provide the standard C libraries libc, POSIX thread libraries libpthread, standard math libraries libm, and the name service cach...

Important: Red Hat Security Advisory: python3 security update

An update for python3 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CVE-2025-53104

gluestack-ui is a library of copy-pasteable components & patterns crafted with Tailwind CSS NativeWind. Prior to commit e6b4271, a command injection vulnerability was discovered in the discussion-to-slack.yml GitHub Actions workflow. Untrusted discussion fields title, body, etc. were directly...