Tagged “csaf”
CVEs tagged csaf, newest first.
7670 CVEsRSS
CVE-2025-20365Medium· 4.3A vulnerability in the IPv6 Router Advertisement (RA) packet processing of Cisco Access Point Software could allow an unauthenticated, adjacent attacker to modify the IPv6 gateway on an affected device. This vulnerability is due to a …
A vulnerability in the IPv6 Router Advertisement (RA) packet processing of Cisco Access Point Software could allow an unauthenticated, adjacent attacker to modify the IPv6 gateway on an affected device. This vulnerability is due to a …
CVE-2025-20364Medium· 4.3A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point (AP) Software could allow an unauthenticated, adjacent attacker to inject wireless 802.11 action frames with arbitrary information. This vu…
A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point (AP) Software could allow an unauthenticated, adjacent attacker to inject wireless 802.11 action frames with arbitrary information. This vu…
CVE-2025-8869Medium· 5.3When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known…
When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known…
CVE-2025-59432Medium· 6.8SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms
SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SC…
CVE-2025-59420High· 7.5authlib: Authlib RFC violation (CVE-2025-59420)
Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, bork or cnf) that s…
CVE-2025-39862High· 8.8⚖ disputedwifi: mt76: mt7915: fix list corruption after hardware restart
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix list corruption after hardware restart Since stations are recreated from scratch, all lists that wcids are added to must be cleared before call…
CVE-2023-53429High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: btrfs: don't check PageError in __extent_writepage __extent_writepage currenly sets PageError whenever any error happens, and the also checks for PageError to decide i…
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't check PageError in __extent_writepage __extent_writepage currenly sets PageError whenever any error happens, and the also checks for PageError to decide i…
CVE-2022-50393High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: SDMA update use unlocked iterator SDMA update page table may be called from unlocked context, this generate below warning
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: SDMA update use unlocked iterator SDMA update page table may be called from unlocked context, this generate below warning. Use unlocked iterator to handle …
CVE-2025-47906Medium· 6.5Unexpected paths returned from LookPath in os/exec
Unexpected paths returned from LookPath in os/exec
CVE-2025-10535High· 7.5⚖ disputedInformation disclosure, mitigation bypass in the Privacy component in Firefox for Android
Information disclosure, mitigation bypass in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 143.
CVE-2025-4953High· 7.4A flaw was found in Podman
A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build c…
CVE-2023-53179High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead t…
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead t…
CVE-2022-50259High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix race in sock_map_free() sock_map_free() calls release_sock(sk) without owning a reference on the socket
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix race in sock_map_free() sock_map_free() calls release_sock(sk) without owning a reference on the socket. This can cause use-after-free as syzbot foun…
CVE-2022-50329High· 7.8In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq Commit 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'") will access 'bic->bfqq' in bic_set_bfqq(), howev…
In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq Commit 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'") will access 'bic->bfqq' in bic_set_bfqq(), howev…
CVE-2022-50252High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: igb: Do not free q_vector unless new one was allocated Avoid potential use-after-free condition under memory pressure
In the Linux kernel, the following vulnerability has been resolved: igb: Do not free q_vector unless new one was allocated Avoid potential use-after-free condition under memory pressure. If the kzalloc() fails, q_vector will be freed b…
CVE-2025-59145Highcolor-name is a JSON with CSS color names
color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over after a phishing attack. Version 2.0.1 was published, functionally identical to the previous patch version, but with …
CVE-2025-59144High· 8.8debug is a JavaScript debugging utility
debug is a JavaScript debugging utility. On 8 September 2025, the npm publishing account for debug was taken over after a phishing attack. Version 4.4.2 was published, functionally identical to the previous patch version, but with a malw…
CVE-2025-9086High· 7.5⚖ disputed1
1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name i…
CVE-2025-39738Medium· 5.5kernel: Linux kernel: Denial of Service in Btrfs due to relocation of partially dropped subvolumes (CVE-2025-39738)
A flaw was found in the Linux kernel. A local user can trigger a transaction abort and a warning in the Btrfs (B-tree file system) by attempting to relocate a partially dropped subvolume that lacks an orphan item. This vulnerability can le…
CVE-2025-39776Medium· 5.5kernel: mm/debug_vm_pgtable: clear page table entries at destroy_args() (CVE-2025-39776)
In the Linux kernel, the following vulnerability has been resolved: mm/debug_vm_pgtable: clear page table entries at destroy_args() The mm/debug_vm_pagetable test allocates manually page table entries for the tests it runs, using also it…
CVE-2025-39787Medium· 6.0kernel: Linux kernel: Denial of Service in MDT loader due to improper ELF header validation (CVE-2025-39787)
A flaw was found in the Linux kernel's soc: qcom: mdt_loader component. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by providing a specially crafted firmware buffer. The flaw occurs because the MDT loader …
CVE-2025-20340High· 7.4A vulnerability in the Address Resolution Protocol (ARP) implementation of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to trigger a broadcast storm, leading to a denial of service (DoS) condition on an affecte…
A vulnerability in the Address Resolution Protocol (ARP) implementation of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to trigger a broadcast storm, leading to a denial of service (DoS) condition on an affecte…
CVE-2025-20159Medium· 5.3A vulnerability in the management interface access control list (ACL) processing feature in Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass configured ACLs for the SSH, NetConf, and gRPC features. This …
A vulnerability in the management interface access control list (ACL) processing feature in Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass configured ACLs for the SSH, NetConf, and gRPC features. This …
CVE-2025-20248Medium· 6.0A vulnerability in the installation process of Cisco IOS XR Software could allow an authenticated, local attacker to bypass Cisco IOS XR Software image signature verification and load unsigned software on an affected device
A vulnerability in the installation process of Cisco IOS XR Software could allow an authenticated, local attacker to bypass Cisco IOS XR Software image signature verification and load unsigned software on an affected device. To exploit t…
CVE-2025-39703Medium· 6.5⚖ disputedkernel: net, hsr: reject HSR frame if skb can't hold tag (CVE-2025-39703)
A flaw was found in the Linux kernel's High-availability Seamless Redundancy (HSR) networking subsystem. This flaw allows an adjacent network attacker or a local user to cause a denial of service (DoS) by transmitting malformed HSR network…
CVE-2025-38733Medium· 5.5⚖ disputedkernel: Linux kernel: Denial of Service due to incorrect lowcore memory mapping (CVE-2025-38733)
A flaw was found in the Linux kernel. Due to an incorrect identity mapping of the lowcore, a critical memory region, NULL pointer accesses may succeed instead of causing an exception. This vulnerability allows a local attacker to cause a D…
CVE-2025-39689Medium· 6.4kernel: ftrace: Also allocate and copy hash for reading of filter files (CVE-2025-39689)
A flaw was found in the Linux kernel. A Use-After-Free (UAF) vulnerability exists in the ftrace subsystem during the reading of tracing filter files. The filter reader retains a direct pointer to global filter data rather than creating an …
CVE-2025-39682Critical· 9.8CISA KEVPoC⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA re…
In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA re…
CVE-2025-9566High· 8.1There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path
There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In…
CVE-2025-55190High· 8.8PoCgithub.com/argoproj/argo-cd: Project API Token Exposes Repository Credentials (CVE-2025-55190)
An information leak was discovered in how Argo CD handles API tokens. The project details API endpoint could provide unintentional access to sensitive repository credentials.