CVE-2025-40172

CVE-2025-40172 is connected to the Linux kernel’s QAIC driver (drivers/accel/qaic/qaic_control.c). The issue arises in find_and_map_user_pages(): when a DMA transfer request from user space has a length of 0, or in a rare case the host/device signals QAIC_TRANS_DMA_XFER_CONT with resources->xf...

PT-2026-6059

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description An HTTP Request Smuggling issue exists in libsoup, an HTTP client/server library. The problem stems from non-RFC-compliant parsing within the soup filter input stream read line function,...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990826)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990826 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation This commit...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990888)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990888 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index out of bounds in DCN30 color transformation This commit addresses a...

CVE-2025-63679

CVE-2025-63679 affects free5gc v4.1.0 and earlier. The root cause is a buffer overflow in the AMF when processing an UplinkRANConfigurationTransfer NGAP message from a gNB, causing the AMF process to crash. Affected component: free5gc’s AMF handling of NGAP messages. Potential impacts per sources...

PT-2025-46650

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the qaic accelerator. Specifically, the find and map user pages function does not properly handle scenarios where a zero-sized ALP Asynchronous...

PT-2025-46697

Name of the Vulnerable Software and Affected Versions free5gc versions 4.1.0 and earlier Description The software contains a buffer overflow issue. When the AMF Application Management Function receives an UplinkRANConfigurationTransfer NGAP New Generation Access Protocol message from a gNB gNodeB...

Linux Distros Unpatched Vulnerability : CVE-2025-40172

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/qaic: Treat remaining == 0 as error in findandmapuserpages Currently, if findandmapuserpages takes a DMA xfer request from the user with a length field se...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990858)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990858 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index out of bounds in degamma hardware format translation Fixes index out o...

CVE-2025-63679

free5gc v4.1.0 and before is vulnerable to Buffer Overflow. When AMF receives an UplinkRANConfigurationTransfer NGAP message from a gNB, the AMF process crashes...

kernel: HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check

In the Linux kernel, the following vulnerability has been resolved: HID: hid-thrustmaster: Fix warning in thrustmasterprobe by adding endpoint check syzbot has found a type mismatch between a USB pipe and the transfer endpoint, which is triggered by the hid-thrustmaster driver1. There is a number...

kernel: crypto: tegra - do not transfer req when tegra init fails

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - do not transfer req when tegra init fails The tegracmacinit or tegrashainit function may return an error when memory is exhausted. It should not transfer the request when they return an error...

RHEL 10 : libssh (RHSA-2025:21013)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:21013 advisory. libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fixes: libssh:...

UBUNTU-CVE-2025-60876

BusyBox wget thru 1.3.7 accepted raw CR 0x0D/LF 0x0A and other C0 control bytes in the HTTP request-target path/query, allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw spac...

Monsta FTP Vulnerability Exposed Thousands of Servers to Full Takeover

Monsta FTP users must update now! A critical pre-authentication flaw CVE-2025-34299 allows hackers to fully take over web servers. Patch to version 2.11.3 immediately...

CVE-2025-60876

BusyBox wget thru 1.3.7 accepted raw CR 0x0D/LF 0x0A and other C0 control bytes in the HTTP request-target path/query, allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw spac...

PT-2025-49370

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's USB-audio driver related to potential overflow of the PCM transfer buffer. The issue arises because the packet sizes used for transferring PCM stream...

CVE-2025-34299

Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious SFTP server...

CVE-2025-34299

Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious SFTP server...

CVE-2025-34299

Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious SFTP server...