CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2025-4432 – Ring: some aes functions may panic when overflow checking is enabled in ring
https://notcve.org/view.php?id=CVE-2025-4432
09 May 2025 — A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induce this panic by sending a specially crafted packet. It will likely occur unintentionally in 1 out of every 2**32 packets sent or received. These are all security issues fixed in the govulncheck-vulndb-0.0.20250515T200012-1.1 package on the GA media of openSUSE Tumbleweed. • https://access.redhat.com/security/cve/CVE-2025-4432 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.2EPSS: 0%CPEs: 3EXPL: 0CVE-2025-4382 – Grub2: grub allow access to encrypted device through cli once root device is unlocked via tpm
https://notcve.org/view.php?id=CVE-2025-4382
09 May 2025 — A flaw was found in systems utilizing LUKS-encrypted disks with GRUB configured for TPM-based auto-decryption. When GRUB is set to automatically decrypt disks using keys stored in the TPM, it reads the decryption key into system memory. If an attacker with physical access can corrupt the underlying filesystem superblock, GRUB will fail to locate a valid filesystem and enter rescue mode. At this point, the disk is already decrypted, and the decryption key remains loaded in system memory. This scenario may al... • https://access.redhat.com/security/cve/CVE-2025-4382 • CWE-306: Missing Authentication for Critical Function •
CVSS: 6.2EPSS: 0%CPEs: 3EXPL: 0CVE-2025-31177 – Gnuplot: gnuplot heap-buffer overflow on utf8_copy_one
https://notcve.org/view.php?id=CVE-2025-31177
07 May 2025 — gnuplot is affected by a heap buffer overflow at function utf8_copy_one. This update for gnuplot fixes the following issues. Invalid read leads to segmentation fault on plot3d_points. Improper bounds check leads to heap-buffer overflow on utf8_copy_one. Unvalidated user input leads to segmentation fault on GetAnnotateString. • https://access.redhat.com/security/cve/CVE-2025-31177 • CWE-122: Heap-based Buffer Overflow •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2025-4373 – Glib: buffer underflow on glib through glib/gstring.c via function g_string_insert_unichar
https://notcve.org/view.php?id=CVE-2025-4373
06 May 2025 — A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the character is large, the position will overflow, leading to a buffer underwrite. It was discovered that Glib incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code. • https://access.redhat.com/security/cve/CVE-2025-4373 • CWE-124: Buffer Underwrite ('Buffer Underflow') •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2025-4035 – Libsoup: cookie domain validation bypass via uppercase characters in libsoup
https://notcve.org/view.php?id=CVE-2025-4035
29 Apr 2025 — A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation. An update for libsoup3 is now available for Red Hat Enterprise Linux 10. Issues addressed include bypass and deni... • https://access.redhat.com/security/cve/CVE-2025-4035 • CWE-178: Improper Handling of Case Sensitivity •
CVSS: 7.8EPSS: 0%CPEs: 28EXPL: 0CVE-2025-3891 – Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled
https://notcve.org/view.php?id=CVE-2025-3891
29 Apr 2025 — A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability. An update for the mod_auth_openidc:2.3 module is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise ... • https://access.redhat.com/security/cve/CVE-2025-3891 • CWE-248: Uncaught Exception •
CVSS: 7.1EPSS: 0%CPEs: 15EXPL: 0CVE-2025-46421 – Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server
https://notcve.org/view.php?id=CVE-2025-46421
24 Apr 2025 — A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect. This update for libsoup fixes the following issues. Fixed heap buffer over-read in 'skip_insignificant_space' when sniffing conten. • https://access.redhat.com/security/cve/CVE-2025-46421 • CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere •
CVSS: 7.8EPSS: 0%CPEs: 15EXPL: 0CVE-2025-46420 – Libsoup: memory leak on soup_header_parse_quality_list() via soup-headers.c
https://notcve.org/view.php?id=CVE-2025-46420
24 Apr 2025 — A flaw was found in libsoup. It is vulnerable to memory leaks in the soup_header_parse_quality_list() function when parsing a quality list that contains elements with all zeroes. This update for libsoup fixes the following issues. Fixed heap buffer over-read in 'skip_insignificant_space' when sniffing conten. Fixed integer overflow in append_param_quoted. • https://access.redhat.com/security/cve/CVE-2025-46420 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2024-10306 – Mod_proxy_cluster: mod_proxy_cluster unauthorized mcmp requests
https://notcve.org/view.php?id=CVE-2024-10306
23 Apr 2025 — A vulnerability was found in mod_proxy_cluster. The issue is that the
CVSS: 9.0EPSS: 0%CPEs: 29EXPL: 0CVE-2025-32911 – Libsoup: double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" ghashtable value
https://notcve.org/view.php?id=CVE-2025-32911
15 Apr 2025 — A flaw was found in libsoup, which is vulnerable to a use-after-free memory issue not on the heap in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server. A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server. This update for libsoup fixes the following is... • https://access.redhat.com/security/cve/CVE-2025-32911 • CWE-590: Free of Memory not on the Heap •