24590 matches found
btrfs: fix assertion when building free space tree
...
comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
...
block: fix race between set_blocksize and read paths
...
hwmon: (corsair-cpro) Validate the size of the received input buffer
...
tracing: Ensure visibility when inserting an element into tracing_map
...
Errors returned from JSON marshaling may break template escaping in html/template
...
ice: add NULL check in eswitch lag check
...
atm: clip: Fix memory leak of struct clip_vcc.
...
net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
...
netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
...
HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
...
ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to large intermediate values that have an integer overflow when squared during statistics calculations. NOTE: this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp calculations, and it did not account for a specific scenario where the original timestamp in the ICMP payload is zero).
...
GNU Binutils ld elf-eh-frame.c _bfd_elf_write_section_eh_frame memory corruption
...
Improper handling of empty HTML attributes in html/template
...
In the Linux kernel through 6.7.1, there is a use-after-free in cec_queue_msg_fh, related to drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c.
...
ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
...
A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination. Impact: * This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.
...
RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem
...
bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
...
Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.
...
Verify panics on certificates with an unknown public key algorithm in crypto/x509
...
mptcp: plug races between subflow fail and subflow creation
...
A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.
...
ALSA: usb-audio: Kill timer properly at removal
...
drm/amdgpu: fix use-after-free bug
...
Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT
...
Helm May Panic Due To Incorrect YAML Content
...
github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives
...
NGINX ngx_mail_smtp_module vulnerability
...
drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink
...
Glib: integer overflow in g_string_maybe_expand() leading to potential buffer overflow in glib gstring
...
Insufficient sanitization of Host header in net/http
...
juliangruber brace-expansion index.js expand redos
...
dm-crypt, dm-verity: disable tasklets
...
PostgreSQL pg_dump newline in object name executes arbitrary code in psql client and in restore target server
...
Memory exhaustion in multipart form parsing in net/textproto and net/http
...
An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.36. It is a stack-overflow issue in demangle_type in rust-demangle.c.
...
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.
...
Grub2: fs/ufs: oob write in the heap
...
ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()
...
xen/events: close evtchn after mapping cleanup
...
wifi: iwlwifi: mvm: guard against invalid STA ID on removal
...
PostgreSQL pg_dump lets superuser of origin server execute arbitrary code in psql client
...
fou: remove warn in gue_gro_receive on unsupported protocol
...
Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).
...
drm/i915: Fix potential context UAFs
...
GNU elfutils eu-readelf readelf.c process_symtab buffer overflow
...
Azure Entra ID Elevation of Privilege Vulnerability
Azure Entra ID Elevation of Privilege Vulnerability...