Vulnerabilities

HomeBox is a home inventory and organization system. Prior to 0.20.1, HomeBox contains a missing authorization check in the API endpoints responsible for updating and deleting inventory item attachments. This flaw allows authenticated users to perform unauthorized actions on inventory item attachments that they do not own. This issue could lead to unauthorized data manipulation or loss of critical inventory data. This issue has been patched in version 0.20.1. There are no workarounds, users must upgrade.

Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). Versions of Filesystem prior to 0.6.4 or 2025.7.01 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 0.6.4 or 2025.7.01 resolve.

Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). Versions of Filesystem prior to 0.6.4 or 2025.7.01 could allow access to unintended files in cases where the prefix matches an allowed directory. Users are advised to upgrade to 0.6.4 or 2025.7.01 resolve.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MintyDocs Extension allows Stored XSS.This issue affects Mediawiki - MintyDocs Extension: from 1.43.X before 1.43.2.

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, in both PostgreSQL and Redshift, apart from parameters like "socketfactory" and "socketfactoryarg", there are also "sslfactory" and "sslfactoryarg" with similar functionality. The difference lies in that "sslfactory" and related parameters need to be triggered after establishing the connection. Other similar parameters include "sslhostnameverifier", "sslpasswordcallback", and "authenticationPluginClassName". This issue has been patched in 2.10.11.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amd/display: check stream id dml21 wrapper to get plane_id<br /> <br /> [Why &amp; How]<br /> Fix a false positive warning which occurs due to lack of correct checks<br /> when querying plane_id in DML21. This fixes the warning when performing a<br /> mode1 reset (cat /sys/kernel/debug/dri/1/amdgpu_gpu_recover):<br /> <br /> [ 35.751250] WARNING: CPU: 11 PID: 326 at /tmp/amd.PHpyAl7v/amd/amdgpu/../display/dc/dml2/dml2_dc_resource_mgmt.c:91 dml2_map_dc_pipes+0x243d/0x3f40 [amdgpu]<br /> [ 35.751434] Modules linked in: amdgpu(OE) amddrm_ttm_helper(OE) amdttm(OE) amddrm_buddy(OE) amdxcp(OE) amddrm_exec(OE) amd_sched(OE) amdkcl(OE) drm_suballoc_helper drm_ttm_helper ttm drm_display_helper cec rc_core i2c_algo_bit rfcomm qrtr cmac algif_hash algif_skcipher af_alg bnep amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_hdmi snd_hda_intel edac_mce_amd snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec kvm_amd snd_hda_core snd_hwdep snd_pcm kvm snd_seq_midi snd_seq_midi_event snd_rawmidi crct10dif_pclmul polyval_clmulni polyval_generic btusb ghash_clmulni_intel sha256_ssse3 btrtl sha1_ssse3 snd_seq btintel aesni_intel btbcm btmtk snd_seq_device crypto_simd sunrpc cryptd bluetooth snd_timer ccp binfmt_misc rapl snd i2c_piix4 wmi_bmof gigabyte_wmi k10temp i2c_smbus soundcore gpio_amdpt mac_hid sch_fq_codel msr parport_pc ppdev lp parport efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic usbhid hid crc32_pclmul igc ahci xhci_pci libahci xhci_pci_renesas video wmi<br /> [ 35.751501] CPU: 11 UID: 0 PID: 326 Comm: kworker/u64:9 Tainted: G OE 6.11.0-21-generic #21~24.04.1-Ubuntu<br /> [ 35.751504] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE<br /> [ 35.751505] Hardware name: Gigabyte Technology Co., Ltd. X670E AORUS PRO X/X670E AORUS PRO X, BIOS F30 05/22/2024<br /> [ 35.751506] Workqueue: amdgpu-reset-dev amdgpu_debugfs_reset_work [amdgpu]<br /> [ 35.751638] RIP: 0010:dml2_map_dc_pipes+0x243d/0x3f40 [amdgpu]<br /> [ 35.751794] Code: 6d 0c 00 00 8b 84 24 88 00 00 00 41 3b 44 9c 20 0f 84 fc 07 00 00 48 83 c3 01 48 83 fb 06 75 b3 4c 8b 64 24 68 4c 8b 6c 24 40 0b b8 06 00 00 00 49 8b 94 24 a0 49 00 00 89 c3 83 f8 07 0f 87<br /> [ 35.751796] RSP: 0018:ffffbfa3805d7680 EFLAGS: 00010246<br /> [ 35.751798] RAX: 0000000000010000 RBX: 0000000000000006 RCX: 0000000000000000<br /> [ 35.751799] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000000<br /> [ 35.751800] RBP: ffffbfa3805d78f0 R08: 0000000000000000 R09: 0000000000000000<br /> [ 35.751801] R10: 0000000000000000 R11: 0000000000000000 R12: ffffbfa383249000<br /> [ 35.751802] R13: ffffa0e68f280000 R14: ffffbfa383249658 R15: 0000000000000000<br /> [ 35.751803] FS: 0000000000000000(0000) GS:ffffa0edbe580000(0000) knlGS:0000000000000000<br /> [ 35.751804] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> [ 35.751805] CR2: 00005d847ef96c58 CR3: 000000041de3e000 CR4: 0000000000f50ef0<br /> [ 35.751806] PKRU: 55555554<br /> [ 35.751807] Call Trace:<br /> [ 35.751810] <br /> [ 35.751816] ? show_regs+0x6c/0x80<br /> [ 35.751820] ? __warn+0x88/0x140<br /> [ 35.751822] ? dml2_map_dc_pipes+0x243d/0x3f40 [amdgpu]<br /> [ 35.751964] ? report_bug+0x182/0x1b0<br /> [ 35.751969] ? handle_bug+0x6e/0xb0<br /> [ 35.751972] ? exc_invalid_op+0x18/0x80<br /> [ 35.751974] ? asm_exc_invalid_op+0x1b/0x20<br /> [ 35.751978] ? dml2_map_dc_pipes+0x243d/0x3f40 [amdgpu]<br /> [ 35.752117] ? math_pow+0x48/0xa0 [amdgpu]<br /> [ 35.752256] ? srso_alias_return_thunk+0x5/0xfbef5<br /> [ 35.752260] ? math_pow+0x48/0xa0 [amdgpu]<br /> [ 35.752400] ? srso_alias_return_thunk+0x5/0xfbef5<br /> [ 35.752403] ? math_pow+0x11/0xa0 [amdgpu]<br /> [ 35.752524] ? srso_alias_return_thunk+0x5/0xfbef5<br /> [ 35.752526] ? core_dcn4_mode_programming+0xe4d/0x20d0 [amdgpu]<br /> [ 35.752663] ? srso_alias_return_thunk+0x5/0xfbef5<br /> [ 35.752669] dml21_validate+0x3d4/0x980 [amdgpu]<br /> <br /> (cherry picked from commit f8ad62c0a93e5dd94243e10f1b742232e4d6411e)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: use list_first_entry_or_null for opinfo_get_list()<br /> <br /> The list_first_entry() macro never returns NULL. If the list is<br /> empty then it returns an invalid pointer. Use list_first_entry_or_null()<br /> to check if the list is empty.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> arm64: dts: qcom: x1e80100: Add GPU cooling<br /> <br /> Unlike the CPU, the GPU does not throttle its speed automatically when it<br /> reaches high temperatures. With certain high GPU loads it is possible to<br /> reach the critical hardware shutdown temperature of 120°C, endangering the<br /> hardware and making it impossible to run certain applications.<br /> <br /> Set up GPU cooling similar to the ACPI tables, by throttling the GPU speed<br /> when reaching 95°C and polling every 200ms.

Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-rc.2, Graylog users can gain elevated privileges by creating and using API tokens for the local Administrator or any other user for whom the malicious user knows the ID. For the attack to succeed, the attacker needs a user account in Graylog. They can then proceed to issue hand-crafted requests to the Graylog REST API and exploit a weak permission check for token creation. This issue has been patched in versions 6.2.4 and 6.3.0-rc.2. A workaround involves disabling the respective configuration found in System &gt; Configuration &gt; Users &gt; "Allow users to create personal access tokens".

WINSTAR WN572HP3 v230525 was discovered to contain a heap overflow via the CONTENT_LENGTH variable at /cgi-bin/upload.cgi.

Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In version 2.10.2, the server accepts links of format file:///etc/passwd and doesn&amp;#39;t do any validation before sending them to parsers and playwright, this can result in leak of other user&amp;#39;s links (and in some cases it might be possible to leak environment secrets). This issue has been patched in version 2.10.3 which has not been made public at time of publication.

An information disclosure vulnerability exists in Ruijie NBR series routers (known to affect NBR2000G, NBR1300G, and NBR1000 models) via the /WEB_VMS/LEVEL15/ endpoint. By crafting a specific POST request with modified Cookie headers and specially formatted parameters, an unauthenticated attacker can retrieve administrative account credentials in plaintext. This flaw allows direct disclosure of sensitive user data due to improper authentication checks and insecure backend logic.