AWS SDK for .NET V4 adopted defense in depth enhancement for region parameter value

This notification is related to the use of specific values for the region input field when calling AWS services. An actor with access to the environment in which the SDK is used could set the region input field to an invalid value. A defense-in-depth enhancement has been implemented in the AWS SD...

CVE-2025-68158

Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state easily obtainable via an attacker-initiated...

libpng: LIBPNG out-of-bounds read in png_image_read_composite

An out of bounds read vulnerability has been discovered in libpng. This vulnerability is in libpng's simplified API allows reading up to 1012 bytes beyond the pngsRGBbase512 array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger...

CVE-2024-2244

REST service authentication anomaly with “valid username/no password” credential combination for batch job processing resulting in successful service invocation. The anomaly doesn’t exist with other credential combinations...

[SECURITY] [DSA 6094-1] libsodium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6094-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 05, 2026 https://www.debian.org/security/faq -...

PT-2026-27697

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's cpufreq subsystem, specifically within the intel pstate driver. Disabling turbo boost via /sys/devices/system/cpu/intel pstate/no turbo can lead to a...

PT-2026-26101

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.9 through 6.10 Description The Linux kernel contains a flaw where the xfarray and xfblob destructors are called with an invalid pointer. This occurs when a valid pointer is not present, potentially leading to system...

PT-2026-7016

Name of the Vulnerable Software and Affected Versions Apache Shiro versions 1. Apache Shiro versions 2. through 2.0.6 Description An observable timing discrepancy exists in Apache Shiro. Before version 2.0.7, the code paths used for non-existent and existing users differ sufficiently, allowing a...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992959)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992959 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/sti: Fix return type of stidvo,hda,hdmiconnectormodevalid With clang's kernel control flow...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992811)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992811 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check numvalidsets before accessing readerwmsets WHY & HOW numvalidsets needs to...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992470)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992470 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/sti: Fix return type of stidvo,hda,hdmiconnectormodevalid With clang's kernel control flow...

Correctness of Extended RSA Public Key Cryptosystem

This paper proposes an alternative approach to formally establishing the correctness of the RSA public key cryptosystem. The methodology presented herein deviates slightly from conventional proofs found in existing literature. Specifically, this study explores the conditions under which the choic...

security/libsodium -- crypto_core_ed25519_is_valid_point mishandles checks for whether an elliptic curve point is valid

Libsodium maintainer reports: The function cryptocoreed25519isvalidpoint, a low-level function used to check if a given elliptic curve point is valid, was supposed to reject points that aren't in the main cryptographic group, but some points were slipping through...

Authentication Bypass

Node-SAML is vulnerable to an Authentication Bypass. The vulnerability is due to loading assertions from the unsigned original SAML response instead of the signature-verified data, allowing attackers to modify authentication details within a valid assertion, such as altering the username, and...

The vulnerability of the nic_valid_size() function in the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability of the nicvalidsize function in the Linux operating system’s kernel is related to the access to an uninitialized pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2025-68257

In the Linux kernel, the following vulnerability has been resolved: comedi: check device's attached status in compat ioctls Syzbot identified an issue 1 that crashes kernel, seemingly due to unexistent callback dev-getvalidroutes. By all means, this should not occur as said callback must always b...

UBUNTU-CVE-2025-68257

In the Linux kernel, the following vulnerability has been resolved: comedi: check device's attached status in compat ioctls Syzbot identified an issue 1 that crashes kernel, seemingly due to unexistent callback dev-getvalidroutes. By all means, this should not occur as said callback must always b...

CVE-2025-68257 comedi: check device's attached status in compat ioctls

In the Linux kernel, the following vulnerability has been resolved: comedi: check device's attached status in compat ioctls Syzbot identified an issue 1 that crashes kernel, seemingly due to unexistent callback dev-getvalidroutes. By all means, this should not occur as said callback must always b...

Linux Distros Unpatched Vulnerability : CVE-2025-68257

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - comedi: check device's attached status in compat ioctls Syzbot identified an issue 1 that crashes kernel, seemingly due to unexistent callback dev-getvalidroute...

Linux Distros Unpatched Vulnerability : CVE-2025-65430

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as isactive=False after having handed tokens for that user while the account was...