Archive
18 September 2025
Vulnerabilities first published on this day (UTC), newest first.
104 results · Clear filters · Feed
-
Medium 6.1
OpenGrok 1.14.1 has a reflected Cross-Site Scripting (XSS) issue when producing the cross reference page. This happens …
-
Medium 6.3
D-Link DIR-645 soap.cgi soapcgi_main command injection
A vulnerability was identified in D-Link DIR-645 105B01. This issue affects the function soapcgi_main of the file /soap.cgi. Such manipulation of the argument service leads to command injection. The attack can be launched remotely. The exploit is publicly ava…
-
Medium 6.7
Buffer manipulation
A crafted system call argument can cause memory corruption.
-
Medium 6.5
Unexpected paths returned from LookPath in os/exec
If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.
-
Medium 4.7
f2fs: don't reset unchangable mount option in f2fs_remount()
In the Linux kernel, the following vulnerability has been resolved: f2fs: don't reset unchangable mount option in f2fs_remount() syzbot reports a bug as below: general protection fault, probably for non-canonical address 0xdffffc0000000009: 0000 [#1] PREEMPT …
-
Medium 5.5
drm/ttm: fix bulk_move corruption when adding a entry
In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix bulk_move corruption when adding a entry When the resource is the first in the bulk_move range, adding it again (thus moving it to the tail) will corrupt the list since the first…
-
Medium 5.5
ice: Block switchdev mode when ADQ is active and vice versa
In the Linux kernel, the following vulnerability has been resolved: ice: Block switchdev mode when ADQ is active and vice versa ADQ and switchdev are not supported simultaneously. Enabling both at the same time can result in nullptr dereference. To prevent th…
-
Medium 5.5
mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak
In the Linux kernel, the following vulnerability has been resolved: mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak In arizona_clk32k_enable(), we should use pm_runtime_resume_and_get() as pm_runtime_get_sync() will increase the refcnt ev…
-
Medium 5.5
bpf: cpumap: Fix memory leak in cpu_map_update_elem
In the Linux kernel, the following vulnerability has been resolved: bpf: cpumap: Fix memory leak in cpu_map_update_elem Syzkaller reported a memory leak as follows: BUG: memory leak unreferenced object 0xff110001198ef748 (size 192): comm "syz-executor.3", pid…
-
Medium 5.5
net: skb_partial_csum_set() fix against transport header magic value
In the Linux kernel, the following vulnerability has been resolved: net: skb_partial_csum_set() fix against transport header magic value skb->transport_header uses the special 0xFFFF value to mark if the transport header was set or not. We must prevent caller…
-
Medium 5.5
x86/MCE: Always save CS register on AMD Zen IF Poison errors
In the Linux kernel, the following vulnerability has been resolved: x86/MCE: Always save CS register on AMD Zen IF Poison errors The Instruction Fetch (IF) units on current AMD Zen-based systems do not guarantee a synchronous #MC is delivered for poison consu…
-
Medium 5.5
media: uvcvideo: Handle cameras with invalid descriptors
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Handle cameras with invalid descriptors If the source entity does not contain any pads, do not create a link.
-
Medium 5.5
scsi: snic: Fix possible memory leak if device_add() fails
In the Linux kernel, the following vulnerability has been resolved: scsi: snic: Fix possible memory leak if device_add() fails If device_add() returns error, the name allocated by dev_set_name() needs be freed. As the comment of device_add() says, put_device(…
-
Medium 5.5
cassini: Fix a memory leak in the error handling path of cas_init_one()
In the Linux kernel, the following vulnerability has been resolved: cassini: Fix a memory leak in the error handling path of cas_init_one() cas_saturn_firmware_init() allocates some memory using vmalloc(). This memory is freed in the .remove() function but no…
-
Medium 5.5
remoteproc: imx_dsp_rproc: Add custom memory copy implementation for i.MX DSP Cores
In the Linux kernel, the following vulnerability has been resolved: remoteproc: imx_dsp_rproc: Add custom memory copy implementation for i.MX DSP Cores The IRAM is part of the HiFi DSP. According to hardware specification only 32-bits write are allowed otherw…
-
Medium 5.5
net: add vlan_get_protocol_and_depth() helper
In the Linux kernel, the following vulnerability has been resolved: net: add vlan_get_protocol_and_depth() helper Before blamed commit, pskb_may_pull() was used instead of skb_header_pointer() in __vlan_get_protocol() and friends. Few callers depended on skb-…
-
Medium 5.5
wifi: mt76: dma: fix memory leak running mt76_dma_tx_cleanup
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: dma: fix memory leak running mt76_dma_tx_cleanup Fix device unregister memory leak and alway cleanup all configured rx queues in mt76_dma_tx_cleanup routine.
-
Medium 5.5
powercap: arm_scmi: Remove recursion while parsing zones
In the Linux kernel, the following vulnerability has been resolved: powercap: arm_scmi: Remove recursion while parsing zones Powercap zones can be defined as arranged in a hierarchy of trees and when registering a zone with powercap_register_zone(), the kerne…
-
Medium 5.5
media: platform: mediatek: vpu: fix NULL ptr dereference
In the Linux kernel, the following vulnerability has been resolved: media: platform: mediatek: vpu: fix NULL ptr dereference If pdev is NULL, then it is still dereferenced. This fixes this smatch warning: drivers/media/platform/mediatek/vpu/mtk_vpu.c:570 vpu_…
-
Medium 5.5
clk: mediatek: fix of_iomap memory leak
In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: fix of_iomap memory leak Smatch reports: drivers/clk/mediatek/clk-mtk.c:583 mtk_clk_simple_probe() warn: 'base' from of_iomap() not released on lines: 496. This problem was als…
-
Medium 5.5
wifi: iwlwifi: fw: fix memory leak in debugfs
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fw: fix memory leak in debugfs Fix a memory leak that occurs when reading the fw_info file all the way, since we return NULL indicating no more data, but don't free the status …
-
Medium 5.5
objtool: Fix memory leak in create_static_call_sections()
In the Linux kernel, the following vulnerability has been resolved: objtool: Fix memory leak in create_static_call_sections() strdup() allocates memory for key_name. We need to release the memory in the following error paths. Add free() to avoid memory leak.
-
Medium 5.5
blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() When blkg_alloc() is called to allocate a blkcg_gq structure with the associated blkg_iostat_set's, there are 2 fields…
-
Medium 5.5
rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access
In the Linux kernel, the following vulnerability has been resolved: rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access For kernels built with CONFIG_PREEMPT_RCU=y, the following scenario can result in a NULL-pointer dereference: CPU1 CPU2 rcu_preempt_…
-
Medium 5.5
wifi: ath11k: mhi: fix potential memory leak in ath11k_mhi_register()
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: mhi: fix potential memory leak in ath11k_mhi_register() mhi_alloc_controller() allocates a memory space for mhi_ctrl. When gets some error, mhi_ctrl should be freed with mhi_fre…
-
Medium 5.5
irqchip/wpcm450: Fix memory leak in wpcm450_aic_of_init()
In the Linux kernel, the following vulnerability has been resolved: irqchip/wpcm450: Fix memory leak in wpcm450_aic_of_init() If of_iomap() failed, 'aic' should be freed before return. Otherwise there is a memory leak.
-
Medium 5.5
parisc: led: Fix potential null-ptr-deref in start_task()
In the Linux kernel, the following vulnerability has been resolved: parisc: led: Fix potential null-ptr-deref in start_task() start_task() calls create_singlethread_workqueue() and not checked the ret value, which may return NULL. And a null-ptr-deref may hap…
-
Medium 5.5
scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails
In the Linux kernel, the following vulnerability has been resolved: scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails fcoe_init() calls fcoe_transport_attach(&fcoe_sw_transport), but when fcoe_if_init() fails, &fcoe_sw_transport is not detach…
-
Medium 5.5
crypto: hisilicon/qm - increase the memory of local variables
In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - increase the memory of local variables Increase the buffer to prevent stack overflow by fuzz test. The maximum length of the qos configuration buffer is 256 bytes. Curr…
-
Medium 5.5
fbdev: fbcon: release buffer when fbcon_do_set_font() failed
In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: release buffer when fbcon_do_set_font() failed syzbot is reporting memory leak at fbcon_do_set_font() [1], for commit a5a923038d70 ("fbdev: fbcon: Properly revert changes when v…
-
Medium 5.5
drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()
In the Linux kernel, the following vulnerability has been resolved: drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() Check the return value of md_bitmap_get_counter() in case it returns NULL pointer, which will result in a null pointer …
-
Medium 4.3
fuyang_lipengjun platform queryAll BrandController improper authorization
A weakness has been identified in fuyang_lipengjun platform 1.0. Affected is the function BrandController of the file /brand/queryAll. Executing manipulation can lead to improper authorization. The attack can be executed remotely. The exploit has been made av…
-
Medium 4.3
fuyang_lipengjun platform queryAll AttributeController improper authorization
A security flaw has been discovered in fuyang_lipengjun platform 1.0. This impacts the function AttributeController of the file /attribute/queryAll. Performing manipulation results in improper authorization. Remote exploitation of the attack is possible. The …
-
Medium 4.3
fuyang_lipengjun platform queryAll AttributeCategoryController improper authorization
A vulnerability was identified in fuyang_lipengjun platform 1.0. This affects the function AttributeCategoryController of the file /attributecategory/queryAll. Such manipulation leads to improper authorization. The attack may be launched remotely. The exploit…
-
Medium 4.3
IBM watsonx.data information disclosure
IBM Lakehouse (watsonx.data 2.2) could allow an authenticated user to obtain sensitive server component version information which could aid in further attacks against the system.
-
Medium 4.7
IBM watsonx.data command execution
IBM Lakehouse (watsonx.data 2.2) could allow an authenticated privileged user to execute arbitrary commands on the system due to improper validation of user supplied input.
-
Medium 5.5
IBM watsonx.data cross-site scripting
IBM Lakehouse (watsonx.data 2.2) is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure …
-
Medium 6.8
Lobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat Messages
Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.129.4, there is a a cross-site scripting (XSS) vulnerability when handling chat message in lobe-chat that can be escalated to remote code execution on the user’s machine. I…
-
Medium 4.3
Tuleap backlog item representations do not verify the permissions of the child trackers
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Backlog item representations do not verify the permissions of the child trackers. Users might see tracker names they should not have access to. This vulnerability…
-
Medium 5.5
USB: gadget: lpc32xx_udc: fix memory leak with using debugfs_lookup()
In the Linux kernel, the following vulnerability has been resolved: USB: gadget: lpc32xx_udc: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make…