CBL Mariner 2.0 Security Update: kernel (CVE-2025-21727)

"The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21727 advisory. - In the Linux kernel, the following vulnerability has been resolved: padata: fix UAF in padatareorder A bug...

SUSE SLES15 Security Update : libva (SUSE-SU-2025:1451-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1451-1 advisory. Update to libva version 2.20.0, which includes security fix for: uncontrolled search path may allow an authenticated user to escalate...

PT-2025-19863 · Qualcomm · Snapdragon +156

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue involves memory corruption during memory mapping into protected VM address space. This occurs due to incorrect API restrictions, which can lead to unauthorized access and...

PT-2025-19878 · Qualcomm · Snapdragon +12

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue is related to memory corruption that occurs while processing an IOCTL request. This happens when the buffer significantly exceeds the command argument limit. Recommendations: At th...

CVE-2025-4286

A vulnerability was found in Intelbras InControl up to 2.21.59. It has been classified as problematic. Affected is an unknown function of the component Dispositivos Edição Page. The manipulation of the argument Senha de Comunicação leads to unprotected storage of credentials. It is possible to...

CVE-2025-46335 Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload

Mobile Security Framework MobSF is a security research platform for mobile applications in Android, iOS and Windows Mobile. A Stored Cross-Site Scripting XSS vulnerability has been identified in MobSF versions up to and including 4.3.2. The vulnerability arises from improper sanitization of...

PYSEC-2025-179

OpenCTI is an open cyber threat intelligence CTI platform. Prior to version 6.4.11 any user with the capability manage customizations can execute commands on the underlying infrastructure where OpenCTI is hosted and can access internal server side secrets by misusing the web-hooks. Since the...

AZL-69926 CVE-2024-58098 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: track changespktdata property for global functions When processing calls to certain helpers, verifier invalidates all packet pointers in a current state. For example, consider the following program: attributenoinline long...

Moderate: Red Hat Security Advisory: nodejs:20 security update

An update for the nodejs:20 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

proc: fix UAF in proc_get_inode()

...

Updated fcgi packages fix security vulnerability

FastCGI fcgi2 aka fcgi 2.x through 2.4.4 has an integer overflow and resultant heap-based buffer overflow via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c. CVE-2025-23016...

PT-2025-19885 · Dell · Dell Storage Manager

Name of the Vulnerable Software and Affected Versions: Dell Storage Center - Dell Storage Manager version 20.1.20 Description: The issue is related to an Improper Authentication vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this, leading to...

Photon OS 5.0: Perl PHSA-2025-5.0-0514

An update of the perl package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0514. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

PT-2025-19343 · Unknown · Alphaefficiencyteam Custom Login/Registration

Name of the Vulnerable Software and Affected Versions: AlphaEfficiencyTeam Custom Login and Registration versions n/a through 1.0.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This...

CVE-2023-53079

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix steering rules cleanup vport's mc, uc and multicast rules are not deleted in teardown path when EEH happens. Since the vport's promisc settingsuc, mc and all in firmware are reset after EEH, mlx5 driver will try to...

CVE-2023-53059

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: crosecchardev: fix kernel data leak from ioctl It is possible to peep kernel page's data by providing larger insize in struct croseccommand1 when invoking EC host commands. Fix it by using zeroed memory. 1:...

CVE-2023-53118

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix a procfs host directory removal regression scsiprochostdirrm decreases a reference counter and hence must only be called once per host that is removed. This change does not require a scsiaddhostwithdma change sinc...

CVE-2023-53127

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix expander node leak in mpi3mrremove Add a missing resource clean up in .remove...

CVE-2023-53110

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL sndbufdesc in smccdctxhandler When performing a stress test on SMC-R by rmmod mlx5ib driver during the wrk/nginx test, we found that there is a probability of triggering a panic while terminating all link groups...

CVE-2023-53092

In the Linux kernel, the following vulnerability has been resolved: interconnect: exynos: fix node leak in probe PM QoS error path Make sure to add the newly allocated interconnect node to the provider before adding the PM QoS request so that the node is freed on errors...