SUSE-SU-2025:0944-1 Security update for the Linux Kernel (Live Patch 45 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-15030059164 fixes several issues. The following security issues were fixed: - CVE-2024-46818: drm/amd/display: Check gpioid before used as array index bsc1231204. - CVE-2024-50302: HID: core: zero-initialize the report buffer bsc1233679. - CVE-2022-48792:...

PT-2025-18216

Name of the Vulnerable Software and Affected Versions vLLM versions 0.6.5 through 0.8.4 Description vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. The issue concerns the use of pickle-based serialization over unsecured ZeroMQ sockets when vLLM is integrated...

Security update for the Linux Kernel (Live Patch 35 for SLE 15 SP4)

This update for the Linux Kernel 5.14.21-15040024147 fixes one issue. The following security issue was fixed: CVE-2024-56648: net: hsr: avoid potential out-of-bound access in fillframeinfo bsc1235452. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods li...

SUSE-SU-2025:0907-1 Security update for the Linux Kernel (Live Patch 50 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-15030059182 fixes one issue. The following security issue was fixed: - CVE-2024-50302: HID: core: zero-initialize the report buffer bsc1233679...

PT-2025-18214 · Finit +1 · Finit +1

Name of the Vulnerable Software and Affected Versions: Finit versions 3.0-rc1 through 4.11 Description: Finit is a fast init for Linux systems. The issue concerns the implementation of getty for the tty configuration directive, which can bypass /bin/login, allowing a user to log in as any user...

leistungselektronik.de Cross Site Scripting vulnerability OBB-4037360

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

next-mobility.de Cross Site Scripting vulnerability OBB-4037355

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

SUSE-SU-2025:0885-1 Security update for the Linux Kernel RT (Live Patch 2 for SLE 15 SP6)

This update for the Linux Kernel 6.4.0-150600108 fixes several issues. The following security issues were fixed: - CVE-2024-46818: drm/amd/display: Check gpioid before used as array index bsc1231204. - CVE-2024-46815: drm/amd/display: Check numvalidsets before accessing readerwmsets bsc1231196. -...

Security Bulletin: Vulnerability in Flatpak affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component.

Summary Potential vulnerability in Flatpak has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. The vulnerability has been addressed. Refer to details for additional information. Vulnerability...

Security update for python

This update for python fixes the following issues: CVE-2024-11168: Fixed improper validation of IPv6 and IPvFuture addresses bsc1233307. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can ru...

CVE-2025-27792

Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, the protections against cross-site request forgery CSRF were insufficient application-wide. The referrer header is checked, and if it is invalid, the server returns 403. However, the referre...

CVE-2024-48873 affecting package kernel for versions less than 6.6.76.1-1

CVE-2024-48873 affecting package kernel for versions less than 6.6.76.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-57911 affecting package kernel for versions less than 6.6.76.1-1

CVE-2024-57911 affecting package kernel for versions less than 6.6.76.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-56716 affecting package kernel for versions less than 6.6.76.1-1

CVE-2024-56716 affecting package kernel for versions less than 6.6.76.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-56640 affecting package kernel for versions less than 6.6.76.1-1

CVE-2024-56640 affecting package kernel for versions less than 6.6.76.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-50609 affecting package fluent-bit for versions less than 3.1.9-3

CVE-2024-50609 affecting package fluent-bit for versions less than 3.1.9-3. A patched version of the package is available...

PT-2025-11189 · Modx · Modx

Name of the Vulnerable Software and Affected Versions: MODX versions prior to 3.1.0 Description: A cross-site scripting XSS issue has been identified. The issue allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims'...

Security Bulletin: Vulnerability in OpenPrinting CUPS affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component.

Summary Potential vulnerability in OpenPrinting CUPS has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. The vulnerability have been addressed. Refer to details for additional information...

Out-of-bounds Read in Ruby JSON Parser

Impact A specially crafted document could cause an out of bound read, most likely resulting in a crash. Versions 2.10.0 and 2.10.1 are impacted. Older versions are not. Patches Version 2.10.2 fixes the problem. Workarounds None...

CVE-2025-27794 Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite

Flarum is open-source forum software. A session hijacking vulnerability exists in versions prior to 1.8.10 when an attacker-controlled authoritative subdomain under a parent domain e.g., subdomain.host.com sets cookies scoped to the parent domain .host.com. This allows session token replacement f...