CVE-2025-21613 go-git has an Argument Injection via the URL field

go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only...

electron32 -- Type Confusion in V8

Electron developers report: This update fixes the following vulnerability: Security: backported fix for CVE-2024-12053...

CVE-2025-21609

CVE-2025-21609 affects SiYuan Note 3.1.18. The vulnerability exists in the POST /api/history/getDocHistoryContent endpoint, where an attacker can craft a payload to cause arbitrary file deletion on the server. The issue is addressed by commit d9887aeec1b27073bec66299a9a4181dc42969f3, with a fix e...

OESA-2025-1008 python-jinja2 security update

Jinja2 is one of the most used template engines for Python. It is inspired by Django's templating system but extends it with an expressive language that gives template authors a more powerful set of tools. On top of that it adds sandboxed execution and optional automatic escaping for applications...

Security update for python-Jinja2

This update for python-Jinja2 fixes the following issues: CVE-2024-56201: Fixed sandbox breakout through malicious content and filename of a template bsc1234808 CVE-2024-56326: Fixed sandbox breakout through indirect reference to format method bsc1234809 Patch Instructions: To install this SUSE...

PT-2025-3336 · Openjpeg +7 · Openjpeg +7

Name of the Vulnerable Software and Affected Versions: OpenJPEG project affected versions not specified Description: A flaw was found in the OpenJPEG project, where a heap buffer overflow condition may be triggered when certain options are specified while using the opj decompress utility. This ca...

PT-2025-19756 · Chromium +3 · Chromium +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 136.0.7103.59 chromium in Debian Linux affected versions not specified Description: The issue is related to insufficient data validation in DevTools, allowing a remote attacker to bypass discretionary access...

PT-2025-37864

Name of the Vulnerable Software and Affected Versions ip aka node-ip package versions through 2.0.1 Description The ip aka node-ip package may allow Server-Side Request Forgery SSRF due to the improper categorization of the IP address value 0 as globally routable via the isPublic function. This...

PT-2025-21068

Name of the Vulnerable Software and Affected Versions: IntelR Core Ultra Processors affected versions not specified Description: The issue concerns incorrect behavior order in some IntelR Core Ultra Processors, potentially allowing an unauthenticated user to enable information disclosure via...

PT-2025-30760

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue in the drm/amd/display subsystem related to DSC / HUBP ONO guarantees. For non-zero DSC instances, the HUBP domain required to drive it for sequential...

PT-2025-54197

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-12 Description ImageMagick is software used for editing and manipulating digital images. Prior to version 7.1.2-12, reading a malicious SVG file with Magick could lead to a denial-of-service DoS attack...

PT-2025-49260

Name of the Vulnerable Software and Affected Versions urllib3 versions 1.24 through 2.5.9 Description urllib3 is a user-friendly HTTP client library for Python. In versions starting from 1.24 and prior to 2.6.0, the decompression chain had an unbounded number of links. This allowed a malicious...

CVE-2024-56198

path-sanitizer is a simple lightweight npm package for sanitizing paths to prevent Path Traversal. Prior to 3.1.0, the filters can be bypassed using .=%5c which results in a path traversal. This vulnerability is fixed in 3.1.0...

CVE-2024-56198 path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability

path-sanitizer is a simple lightweight npm package for sanitizing paths to prevent Path Traversal. Prior to 3.1.0, the filters can be bypassed using .=%5c which results in a path traversal. This vulnerability is fixed in 3.1.0...

CVE-2024-56198

The CVE concerns the npm package path-sanitizer. Prior to version 3.1.0, its path-filtering can be bypassed with the sequence .=%5c, enabling path traversal. The vulnerability is fixed in 3.1.0. Affected software is the path-sanitizer package (node/npm), and the practical impact is potential acce...

CVE-2024-56198 path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability

path-sanitizer is a simple lightweight npm package for sanitizing paths to prevent Path Traversal. Prior to 3.1.0, the filters can be bypassed using .=%5c which results in a path traversal. This vulnerability is fixed in 3.1.0...

CVE-2024-56643

In the Linux kernel, the following vulnerability has been resolved: dccp: Fix memory leak in dccpfeatchangerecv If dccpfeatpushconfirm fails after new value for SP feature was accepted without reconciliation 'entry == NULL' branch, memory allocated for that value with dccpfeatclonespval is never...

CVE-2024-56752

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/gr/gf100: Fix missing unlock in gf100grchannew When the call to gf100grctxgenerate fails, unlock gr-fecs.mutex before returning the error. Fixes smatch warning: drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c:480...

CVE-2024-56720

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Several fixes to bpfmsgpopdata Several fixes to bpfmsgpopdata, 1. In skmsgshiftleft, we should putpage 2. if len == 0, return early is better 3. pop the entire skmsg last == msg-sg.size should be supported 4. Fix...

CVE-2024-56749

In the Linux kernel, the following vulnerability has been resolved: dlm: fix dlmrecovermembers refcount on error If dlmrecovermembers fails we don't drop the references of the previous created rootlist that holds and keep all rsbs alive during the recovery. It might be not an unlikely event becau...