CVE-2025-38375 affecting package kernel for versions less than 6.6.104.2-1

CVE-2025-38375 affecting package kernel for versions less than 6.6.104.2-1. An upgraded version of the package is available that resolves this issue...

DNS Rebinding

Overview Affected versions of this package are vulnerable to DNS Rebinding when hosted over plain HTTP on localhost. An attacker can access sensitive user data and chat history via the /messages endpoint that may include secret keys, file system contents, and intellectual property by enticing the...

Linux Distros Unpatched Vulnerability : CVE-2025-59825

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of...

CVE-2025-54831

Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a "write-only" model for sensitive values. In Airflow 3.0.3, this model was...

CVE-2025-59844 Argument injection vulnerability in SonarQube Scan Action

SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. A command injection vulnerability exists in SonarQube GitHub Action in version 4.0.0 to before version 6.0.0 when workflows pass user-controlled input to the args parameter on Windows...

CVE-2025-59843

Flag Forge is a Capture The Flag CTF platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/username returns user email addresses in its JSON response. The fix, intended for release in 2.3.1 but only available starting in version 2.3.2, removes email addresses from public AP...

CVE-2025-59843

Flag Forge CT F platform vulnerable due to public /api/user/[username] endpoint exposing user email addresses. From versions 2.0.0 up to before 2.3.2, responses include emails in JSON. The fix was planned for 2.3.1 but only shipped in 2.3.2, after which email addresses are removed from public API...

CVE-2025-59843 FlagForgeCTF Exposes User Emails via Public /api/user/[username] API

Flag Forge is a Capture The Flag CTF platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/username returns user email addresses in its JSON response. The fix, intended for release in 2.3.1 but only available starting in version 2.3.2, removes email addresses from public AP...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the SAML authentication component. An attacker can obtain authentication tokens belonging to another user by crafting a phishing login URL containing attacker-controlled publicKey and...

Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software VPN Web Server Unauthorized Access Vulnerability

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial...

DEBIAN-CVE-2025-59825

astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the Entry::unpackinraw API. Additionally, the Entry::allowexternalsymlinks control which...

UBUNTU-CVE-2025-59825

astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the Entry::unpackinraw API. Additionally, the Entry::allowexternalsymlinks control which...

CVE-2025-59825 astral-tokio-tar has a path traversal in tar extraction

astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the Entry::unpackinraw API. Additionally, the Entry::allowexternalsymlinks control which...

CVE-2025-59825 astral-tokio-tar has a path traversal in tar extraction

astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the Entry::unpackinraw API. Additionally, the Entry::allowexternalsymlinks control which...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the initializekerberoskeytabfilelogin function. An attacker can execute arbitrary commands by supplying crafted input that is interpolated into a shell command and executed without sanitization. Remediation Upgrade...

astral-tokio-tar has a path traversal in tar extraction

Impact In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the Entry::unpackinraw API. Additionally, the Entry::allowexternalsymlinks control which defaults to true could be bypassed via a pair of symlinks that...

PT-2025-39215

Name of the Vulnerable Software and Affected Versions astral-tokio-tar versions 0.5.3 and earlier Description astral-tokio-tar is a tar archive reading/writing library for async Rust. Tar archives may extract files outside of their intended destination directory when using the Entry::unpack in ra...

CVE-2024-33394 affecting package kubevirt for versions less than 1.5.0-2

CVE-2024-33394 affecting package kubevirt for versions less than 1.5.0-2. An upgraded version of the package is available that resolves this issue...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via the nghttp2 process. An attacker can exhaust CPU resources by sending specially crafted DNS over HTTPS exchanges that trigger an unbounded I/O read loop. This is only exploitable if the system is configured to use the...

GHSA-393W-9X6H-8GC7 Pingora update for MadeYouReset HTTP/2 vulnerability

Pingora deployments that include HTTP/2 server support may be affected by the vulnerability described in CVE-2025-8671. Under certain conditions, Pingora applications may allocate buffers before the HTTP/2 reset and resulting stream cancellation is processed by the server. Repeated resets can for...