CVE-2022-49837

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix memory leaks in checkfunccall kmemleak reports this issue: unreferenced object 0xffff88817139d000 size 2048: comm "testprogs", pid 33246, jiffies 4307381979 age 45851.820s hex dump first 32 bytes: 01 00 00 00 00 00 00 00...

CVE-2025-37782

CVE-2025-37782 affects the kernel package for versions earlier than 6.6.92.2-1. An upgraded kernel version (≥ 6.6.92.2-1) resolves the issue. No exploit details are provided in the connected documents. If using affected distributions, upgrade to the specified kernel version to mitigate.

CVE-2025-37782

...

CVE-2025-23147 i3c: Add NULL pointer check in i3c_master_queue_ibi()

In the Linux kernel, the following vulnerability has been resolved: i3c: Add NULL pointer check in i3cmasterqueueibi The I3C master driver may receive an IBI from a target device that has not been probed yet. In such cases, the master calls i3cmasterqueueibi to queue an IBI work task, leading to...

DLA-4126-2 jinja2 - regression update

Bulletin has no description...

CVE-2025-30194

A flaw was found in DNSdist's DoH implementation using the nghttp2 provider. This vulnerability allows denial of service via a specially crafted DoH exchange that triggers a double-free memory error. Mitigation Mitigation for this issue is either not available or the currently available options d...

VIMU: Effective Physics-Based Realtime Detection and Recovery against Stealthy Attacks on UAVs

Sensor attacks on robotic vehicles have become pervasive and manipulative. Their latest advancements exploit sensor and detector characteristics to bypass detection. Recent security efforts have leveraged the physics-based model to detect or mitigate sensor attacks. However, these approaches are...

CVE-2025-46687

quickjs-ng through 0.9.0 has a missing length check in JSReadString for a string, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

Virtuozzo Hybrid Infrastructure 6.3 Update 1 Hotfix 2 (6.3.1-121)

This update provides stability fixes. Vulnerability id: VSTOR-88806 Live migration failed for VMs with both vstorage and iSCSI volumes. Vulnerability id: VSTOR-89155 Fixed the false-positive alerts "Virtual machine state mismatch" and "Volume attachment details mismatch." Vulnerability id:...

CVE-2025-43966

A flaw was found in libheif. In affected versions, a NULL pointer dereference occurs in ImageItemiden in image-items/iden.cc. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use an...

CVE-2025-43929

A flaw was found in kitty. This vulnerability allows arbitrary code execution via execution of a locally linked executable without user confirmation. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria...

CVE-2025-32415

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used. Mitigation...

CVE-2025-22123 f2fs: fix to avoid accessing uninitialized curseg

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid accessing uninitialized curseg syzbot reports a f2fs bug as below: F2FS-fs loop3: Stopped filesystem due to reason: 7 kworker/u8:7: attempt to access beyond end of device BUG: unable to handle page fault for...

CVE-2025-3573

A flaw was found in the jquery-validation package. This vulnerability allows Cross-site scripting XSS via a user-controlled placeholder value passed to the showLabel function, which populates messages using the $.validator.messages dictionary. Mitigation Mitigation for this issue is either not...

CVE-2025-3277

A flaw was found in SQLite’s concatws function, where an integer overflow can be triggered. The resulting truncated integer can allocate a buffer. When SQLite writes the resulting string to the buffer, it uses the original, untruncated size, and a wild heap buffer overflow size of around 4GB can...

CVE-2025-24358

gorilla/csrf provides Cross Site Request Forgery CSRF prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes...

SUSE-SU-2025:1260-1 Security update for the Linux Kernel (Live Patch 44 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-15030059161 fixes several issues. The following security issues were fixed: - CVE-2022-49014: net: tun: Fix use-after-free in tundetach bsc1232818. - CVE-2022-49563: crypto: qat - add param check for RSA bsc1238788. - CVE-2022-49564: crypto: qat - add param...

CVE-2025-2814

A flaw was found in Crypt::CBC. Affected versions of Perl may use the rand function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. This issue affects operating systems where "/dev/urandom'" is unavailable. In that case, Crypt::CBC will fall...

📄 Langflow AI Remote Code Execution

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source:...

CVE-2025-32395

A flaw was found in Vite. This vulnerability allows arbitrary file access via specially crafted HTTP requests containing a character in the request URL. The issue occurs when the server is run on Node.js or Bun and exposed to the network. Improper handling of invalid request lines allows these...