CVE-2025-54880

A Cross-site scripting XSS flaw was found in the Mermaid JavaScript diagramming and charting tool. In the default configuration of Mermaid, user-supplied input for architecture diagram icons is passed to the d3.html method, creating a sink for Cross-site scripting. Mitigation Mitigation for this...

CVE-2025-38605

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Pass ab pointer directly to ath12kdptxgetencaptype In ath12kdptxgetencaptype, the arvif parameter is only used to retrieve the ab pointer. In vdev delete sequence the arvif-ar could become NULL and that would trigge...

CVE-2025-9162

A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are...

CVE-2025-41242

A path traversal flaw was found in the Spring Framework MVC, affecting applications built on this framework. This flaw only affects applications that are deployed as a WAR or with an embedded Servlet container, which do not reject suspicious sequences and serve static resources with Spring resour...

Huawei HarmonyOS card management module iterator failure vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. An iterator failure vulnerability exists in the Huawei HarmonyOS card management module, which can be exploited by attackers to affect functional stability...

Huawei HarmonyOS Iterator Failure Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS suffers from an Iterator Failure vulnerability that can be exploited by attackers to affect functional stability...

Huawei HarmonyOS cjwindow Module Pointer Dangling Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A pointer dangling vulnerability exists in the Huawei HarmonyOS cjwindow module, which can be exploited by an attacker to cause functional stability to be...

UBUNTU-CVE-2025-38507

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: avoid bluetooth suspend/resume stalls Ensure we don't stall or panic the kernel when using bluetooth-connected controllers. This was reported as an issue on android devices using kernel 6.6 due to the resume hook...

CVE-2025-8959

A flaw was found in HashiCorp’s go-getter library subdirectory download feature, where it is vulnerable to symlink attacks. This vulnerability can lead to unauthorized read access beyond the designated directory boundaries. Mitigation Mitigation for this issue is either not available or the...

CVE-2025-55285

A flaw has been discovered in the @backstage/plugin-scaffolder-backend npm package that can lead to an information leak. The fetch:template action in the Scaffolder improperly duplicates logging of input values, which can bypass the intended redaction of secrets. This means that an attacker with...

CVE-2025-24975

A flaw has been discovered in the Firebird SQL project that can lead to an access bypass. If connections stored in the ExtConnPool are not properly verified for the CryptCallback interface upon creation, it could cause a server process segmentation fault. This vulnerability could allow an...

CVE-2025-9019

A flaw was found in tcpreplay. The maskcidr6 function in cidr.c contains a heap-based buffer overflow triggered by manipulation of network packets. A remote attacker can initiate the overflow by providing a specially crafted packet. This buffer overflow can lead to an application level denial of...

CVE-2025-50518

A flaw was found in libcoap. The coapdeletepdulkd function in coappdu.c exhibits a use-after-free condition due to improper memory management following the deallocation of a Packet Data Unit PDU object. This can allow a local attacker to trigger memory corruption. Exploitation occurs when a freed...

CVE-2025-8714

A flaw was found in PostgreSQL. This vulnerability allows a malicious superuser on a PostgreSQL server to inject arbitrary code into dump files created by pgdump, pgdumpall, and pgrestore, causing arbitrary code execution on the client machine when these dump files are restored by psql due to...

CVE-2025-55668

A session fixation vulnerability has been identified in Apache Tomcat, affecting its rewrite functionality. If the rewrite valve is enabled for a web application, an attacker can craft a specific URL. If a victim clicks on this malicious URL, their subsequent interaction with the resource will...

CVE-2025-55154

An integer overflow flaw has been discovered in ImageMagick. The magnified size calculations in ReadOneMNGIMage in coders/png.c are unsafe and can overflow, leading to memory corruption. Mitigation Mitigation for this issue is either not available or the currently available options do not meet th...

CVE-2025-55004

A heap-based buffer overflow flaw was found in ImageMagick. This issue is present when handling images with separate alpha channels and performing image magnification in ReadOneMNGIMage. This vulnerability could be exploited to leak subsequent memory contents into the output image. Mitigation...

CVE-2025-8916

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All API modules, Legion of the Bouncy Castle Inc. BC Java bcprov on All API modules, Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All API modules allows Excessiv...

Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Updated to version 2.48.5: - CVE-2025-31273: Fixed a vulnerability where processing maliciously crafted web content could lead to memory corruption. bsc1247564 - CVE-2025-31278: Fixed a vulnerability where processing maliciously crafted web...

CVE-2025-8879

A flaw was found in chromium-browser. A heap buffer overflow exists within the libaom library, allowing a remote attacker to potentially trigger heap corruption through a crafted sequence of gestures. This vulnerability allows an attacker to manipulate memory via a specially designed input. The...