Important: kernel-livepatch-6.12.31-35.92

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix backlog accounting in qdiscdequeueinternal CVE-2025-39677 Affected Packages: kernel-livepatch-6.12.31-35.92 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

PT-2025-39909

Name of the Vulnerable Software and Affected Versions vet versions prior to 1.12.5 Description The software is susceptible to a DNS rebinding attack because of missing HTTP Host and Origin header validation. When used as an MCP server in SSE mode with default ports, the sqlite3 database containin...

CVE-2025-59938

CVE-2025-59938 affects Wazuh wazuh-analysisd in versions 3.8.0 through 4.10.x (before 4.11.0). The issue is a heap buffer overflow when parsing XML elements from Windows EventChannel messages, with a documented fix in version 4.11.0. CVSS 3.1 base score 6.5 (Medium) indicates impact limited to av...

CVE-2025-59845 Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass

Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL. Prior to Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3, a cross-site request forgery CSRF vulnerability was identified. The vulnerability arises from missing orig...

CVE-2025-59828 Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions

Claude Code is an agentic coding tool. Prior to Claude Code version 1.0.39, when using Claude Code with Yarn versions 2.0+, Yarn plugins are auto-executed when running yarn --version. This could lead to a bypass of the directory trust dialog in Claude Code, as plugins would be executed prior to t...

CVE-2022-50408

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free bug in brcmfnetdevstartxmit ret = brcmfprototxqueuedatadrvr, ifp-ifidx, skb; may be schedule, and then complete before the line ndev-stats.txbytes += skb-len; 46.912801...

CVE-2023-53443

In the Linux kernel, the following vulnerability has been resolved: mfd: arizona: Use pmruntimeresumeandget to prevent refcnt leak In arizonaclk32kenable, we should use pmruntimeresumeandget as pmruntimegetsync will increase the refcnt even when it returns an error...

CVE-2025-43375

The issue was addressed with improved checks. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process...

CVE-2025-59351 Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the first return value of a function is dereferenced even when the function returns an error. This can result in a nil dereference, and cause code to panic. This vulnerability is fixed in 2.1.0...

CVE-2022-50344

In the Linux kernel, the following vulnerability has been resolved: ext4: fix null-ptr-deref in ext4writeinfo I caught a null-ptr-deref bug as follows: ================================================================== KASAN: null-ptr-deref in range 0x0000000000000068-0x000000000000006f CPU: 1 PI...

CVE-2023-53295

CVE-2023-53295 affects the Linux kernel, specifically the UDF module. The issue occurs when writing to inline files fails (or is only partially successful); the kernel wrongly updates the file length as if the entire write had succeeded. Root cause: updating length of inline data on failed writes...

SUSE SLES15 Security Update : kernel (Live Patch 13 for SLE 15 SP6) (SUSE-SU-2025:03214-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2025:03214-1 advisory. This update for the Linux Kernel 6.4.0-1506002360 fixes several issues. The following security issue was fixed: - CVE-2025-38212: ipc: fix to protect...

CVE-2022-50292

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: fix bridge lifetime Device-managed resources allocated post component bind must be tied to the lifetime of the aggregate DRM device or they will not necessarily be released when binding of the aggregate device is...

CVE-2023-53229

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix invalid drvstaprercuremove calls for non-uploaded sta Avoid potential data corruption issues caused by uninitialized driver private data structures...

CVE-2023-53218

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Make it so that a waiting process can be aborted When sendmsg creates an rxrpc call, it queues it to wait for a connection and channel to be assigned and then waits before it can start shovelling data as the encrypted DATA...

CVE-2023-53204

In the Linux kernel, the following vulnerability has been resolved: afunix: Fix data-races around user-unixinflight. user-unixinflight is changed under spinlockunixgclock, but toomanyunixfds reads it locklessly. Let's annotate the write/read accesses to user-unixinflight. BUG: KCSAN: data-race in...

CVE-2023-53177

In the Linux kernel, the following vulnerability has been resolved: media: hi846: fix usage of pmruntimegetifinuse pmruntimegetifinuse does not only return nonzero values when the device is in use, it can return a negative errno too. And especially during resuming from system suspend, when runtim...

PT-2025-37824

Name of the Vulnerable Software and Affected Versions: macOS versions prior to Sequoia 15.7 macOS versions prior to Sonoma 14.8 macOS versions prior to Tahoe 26 Description: An application may be able to access protected user data due to vulnerable code. The vulnerable code has been removed in th...

CVE-2025-39789

In the Linux kernel, the following vulnerability has been resolved: crypto: x86/aegis - Add missing error checks The skcipherwalk functions can allocate memory and can fail, so checking for errors is necessary...

Advisory ROSA-SA-2025-3005

software: gimp 2.10.36 WASP: ROSA-CHROME unaffected versions = gimp-2.10.36-4 affected versions gimp-2.10.36-4 CVE-ID: CVE-2025-5473 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: An integer overflow vulnerability in GIMP parsing ICO files allows remote attackers to execute arbitrary code. User interacti...