CVSS: 7.8EPSS: 0%CPEs: 35EXPL: 0CVE-2025-26595 – Xorg: xwayland: buffer overflow in xkbvmodmasktext()
https://notcve.org/view.php?id=CVE-2025-26595
25 Feb 2025 — A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size. This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit t... • https://access.redhat.com/security/cve/CVE-2025-26595 • CWE-121: Stack-based Buffer Overflow •
CVSS: 7.8EPSS: 0%CPEs: 35EXPL: 0CVE-2025-26594 – X.org: xwayland: use-after-free of the root cursor
https://notcve.org/view.php?id=CVE-2025-26594
25 Feb 2025 — A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free. This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the h... • https://access.redhat.com/security/cve/CVE-2025-26594 • CWE-416: Use After Free •
CVSS: 7.1EPSS: 43%CPEs: 31EXPL: 2CVE-2025-26465 – Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled
https://notcve.org/view.php?id=CVE-2025-26465
18 Feb 2025 — A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high. ssh(1) contains a logic error that allows an on-path attacker ... • https://github.com/rxerium/CVE-2025-26465 • CWE-390: Detection of Error Condition Without Action •
CVSS: 5.9EPSS: 46%CPEs: 11EXPL: 4CVE-2025-26466 – Openssh: denial-of-service in openssh
https://notcve.org/view.php?id=CVE-2025-26466
18 Feb 2025 — A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack. ssh(1) contains a logic error that allows an on-path attac... • https://github.com/rxerium/CVE-2025-26466 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 8.1EPSS: 83%CPEs: 14EXPL: 6CVE-2025-1094 – PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation
https://notcve.org/view.php?id=CVE-2025-1094
13 Feb 2025 — Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command li... • https://packetstorm.news/files/id/189316 • CWE-149: Improper Neutralization of Quoting Syntax •
CVSS: 5.6EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31068 – Ubuntu Security Notice USN-7269-1
https://notcve.org/view.php?id=CVE-2024-31068
12 Feb 2025 — Improper Finite State Machines (FSMs) in Hardware Logic for some Intel(R) Processors may allow privileged user to potentially enable denial of service via local access. Ke Sun, Paul Grosen and Alyssa Milburn discovered that some Intel® Processors did not properly implement Finite State Machines in Hardware Logic. A local privileged attacker could use this issue to cause a denial of service. It was discovered that some Intel® Processors with Intel® SGX did not properly restrict access to the EDECCSSA user le... • https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01166.html • CWE-1245: Improper Finite State Machines (FSMs) in Hardware Logic •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-36293 – Ubuntu Security Notice USN-7269-1
https://notcve.org/view.php?id=CVE-2024-36293
12 Feb 2025 — Improper access control in the EDECCSSA user leaf function for some Intel(R) Processors with Intel(R) SGX may allow an authenticated user to potentially enable denial of service via local access. Ke Sun, Paul Grosen and Alyssa Milburn discovered that some Intel® Processors did not properly implement Finite State Machines in Hardware Logic. A local privileged attacker could use this issue to cause a denial of service. It was discovered that some Intel® Processors with Intel® SGX did not properly restrict acc... • https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01213.html • CWE-284: Improper Access Control •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37020 – SUSE Security Advisory - SUSE-SU-2025:0591-1
https://notcve.org/view.php?id=CVE-2024-37020
12 Feb 2025 — Sequence of processor instructions leads to unexpected behavior in the Intel(R) DSA V1.0 for some Intel(R) Xeon(R) Processors may allow an authenticated user to potentially enable denial of service via local access. These are all security issues fixed in the ucode-intel-20250211-1.1 package on the GA media of openSUSE Tumbleweed. • https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01194.html • CWE-1281: Sequence of Processor Instructions Leads to Unexpected Behavior •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-39355 – SUSE Security Advisory - SUSE-SU-2025:0591-1
https://notcve.org/view.php?id=CVE-2024-39355
12 Feb 2025 — Improper handling of physical or environmental conditions in some Intel(R) Processors may allow an authenticated user to enable denial of service via local access. These are all security issues fixed in the ucode-intel-20250211-1.1 package on the GA media of openSUSE Tumbleweed. • https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01228.html • CWE-1384: Improper Handling of Physical or Environmental Conditions •
CVSS: 8.7EPSS: 0%CPEs: 1EXPL: 0CVE-2023-43758
https://notcve.org/view.php?id=CVE-2023-43758
12 Feb 2025 — Improper input validation in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privilege via local access. • https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html • CWE-20: Improper Input Validation •