{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "Siemens heeft kwetsbaarheden verholpen in verschillende (OT-)producten. Het gaat onder andere om producten in de Siemens RUGGEDCOM-, SCALANCE-, SIMATIC-, SIMIT-, SINAMICS-, SIPROTEC-, SENTRON- en Solid Edge-productreeksen.", "title": "Feiten" }, { "category": "description", "text": "De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:\n\n- Denial-of-Service (DoS)\n- Manipulatie van gegevens\n- (Remote) code execution\n- Toegang tot gevoelige gegevens\n- Verhogen van rechten\n\nVoor succesvol misbruik van de genoemde kwetsbaarheden moet de kwaadwillende (netwerk)toegang hebben tot het kwetsbare product. Het is goed gebruik een dergelijke producten niet publiek toegankelijk te hebben.", "title": "Interpretaties" }, { "category": "description", "text": "Siemens heeft beveiligingsupdates uitgebracht om de kwetsbaarheden te verhelpen. Voor de kwetsbaarheden waar nog geen updates voor zijn, heeft Siemens mitigerende maatregelen gepubliceerd om de risico's zoveel als mogelijk te beperken. Zie de bijgevoegde referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Improper Input Validation", "title": "CWE-20" }, { "category": "general", "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "title": "CWE-22" }, { "category": "general", "text": "Relative Path Traversal", "title": "CWE-23" }, { "category": "general", "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "title": "CWE-78" }, { "category": "general", "text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "title": "CWE-79" }, { "category": "general", "text": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')", "title": "CWE-88" }, { "category": "general", "text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "title": "CWE-89" }, { "category": "general", "text": "Improper Neutralization of CRLF Sequences ('CRLF Injection')", "title": "CWE-93" }, { "category": "general", "text": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')", "title": "CWE-113" }, { "category": "general", "text": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "title": "CWE-119" }, { "category": "general", "text": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "title": "CWE-120" }, { "category": "general", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "general", "text": "Heap-based Buffer Overflow", "title": "CWE-122" }, { "category": "general", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "general", "text": "Improper Validation of Array Index", "title": "CWE-129" }, { "category": "general", "text": "Incorrect Calculation of Buffer Size", "title": "CWE-131" }, { "category": "general", "text": "Improper Neutralization of Escape, Meta, or Control Sequences", "title": "CWE-150" }, { "category": "general", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "general", "text": "Integer Underflow (Wrap or Wraparound)", "title": "CWE-191" }, { "category": "general", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "general", "text": "Observable Discrepancy", "title": "CWE-203" }, { "category": "general", "text": "Observable Timing Discrepancy", "title": "CWE-208" }, { "category": "general", "text": "Improper Check for Dropped Privileges", "title": "CWE-273" }, { "category": "general", "text": "Insecure Inherited Permissions", "title": "CWE-277" }, { "category": "general", "text": "Improper Access Control", "title": "CWE-284" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-078743.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-081142.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-085541.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-357982.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-387223.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-392349.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-545643.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-577017.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-688146.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-783943.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-786884.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-827383.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-870926.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-876049.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-921111.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-973901.html" } ], "title": "Kwetsbaarheden verholpen in Siemens-producten", "tracking": { "current_release_date": "2026-05-13T06:33:28.624303Z", "generator": { "date": "2025-08-04T16:30:00Z", "engine": { "name": "V.A.", "version": "1.3" } }, "id": "NCSC-2026-0147", "initial_release_date": "2026-05-13T06:33:28.624303Z", "revision_history": [ { "date": "2026-05-13T06:33:28.624303Z", "number": "1.0.0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-1" } } ], "category": "product_name", "name": "IE/PB-Link Firmware (OS)" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-2" } } ], "category": "product_name", "name": "IE/PB-link Firmware" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-3" } } ], "category": "product_name", "name": "Opcenter RDnL" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-4" } } ], "category": "product_name", "name": "RUGGEDCOM ROX II" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-5" } } ], "category": "product_name", "name": "RUGGEDCOM ROX II Family" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-6" } } ], "category": "product_name", "name": "RUGGEDCOM ROX II family" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-7" } } ], "category": "product_name", "name": "SCALANCE M-800" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-8" } } ], "category": "product_name", "name": "SCALANCE M-800 family" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-9" } } ], "category": "product_name", "name": "SCALANCE SC-600" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-10" } } ], "category": "product_name", "name": "SCALANCE SC-600 Family" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-11" } } ], "category": "product_name", "name": "SCALANCE SC-600 family" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-12" } } ], "category": "product_name", "name": "SCALANCE W-700 IEEE 802.11n family" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-13" } } ], "category": "product_name", "name": "SCALANCE X-200 series firmware" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-14" } } ], "category": "product_name", "name": "SCALANCE X-300 Series Firmware" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-15" } } ], "category": "product_name", "name": "SCALANCE XM-400" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-16" } } ], "category": "product_name", "name": "SCALANCE XM-400 Family" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-17" } } ], "category": "product_name", "name": "SCALANCE XM-400 family" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-18" } } ], "category": "product_name", "name": "SCALANCE XR-500 Family" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-19" } } ], "category": "product_name", "name": "SCALANCE XR-500 family" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-20" } } ], "category": "product_name", "name": "SIMATIC CFU DIQ" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-21" } } ], "category": "product_name", "name": "SIMATIC CFU PA" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-22" } } ], "category": "product_name", "name": "SIMATIC ET 200 SP Firmware" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-23" } } ], "category": "product_name", "name": "SIMATIC HMI Unified Comfort Panels" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-24" } } ], "category": "product_name", "name": "SIMATIC HMI Unified Comfort Panels Firmware" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-25" } } ], "category": "product_name", "name": "SIMATIC HMI Unified Comfort Panels family" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-26" } } ], "category": "product_name", "name": "SIMATIC S7" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-27" } } ], "category": "product_name", "name": "SIMATIC S7-1500" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-28" } } ], "category": "product_name", "name": "SIMATIC S7-300" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-29" } } ], "category": "product_name", "name": "SIMATIC S7-410" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-30" } } ], "category": "product_name", "name": "SIMIT" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-31" } } ], "category": "product_name", "name": "SINAMICS G115D" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-32" } } ], "category": "product_name", "name": "SINAMICS G130" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-33" } } ], "category": "product_name", "name": "SINAMICS S110" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-34" } } ], "category": "product_name", "name": "SINAMICS S150" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-35" } } ], "category": "product_name", "name": "SIPROTEC 5" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-36" } } ], "category": "product_name", "name": "Scalance W-700 Ieee 80211N Family" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-37" } } ], "category": "product_name", "name": "Scalance X-200 Firmware" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-38" } } ], "category": "product_name", "name": "Scalance X-300" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-39" } } ], "category": "product_name", "name": "Sentron PAC" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-40" } } ], "category": "product_name", "name": "Simatic S7-400 Firmware" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-41" } } ], "category": "product_name", "name": "Simcenter Femap" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-42" } } ], "category": "product_name", "name": "Sinamics G120" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-43" } } ], "category": "product_name", "name": "Sinamics S120" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-44" } } ], "category": "product_name", "name": "Solid Edge SE2026" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-45" } } ], "category": "product_name", "name": "Teamcenter" } ], "category": "vendor", "name": "Siemens" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-46" } } ], "category": "product_name", "name": "SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SINUMERIK 840D sl V4.8" } ], "category": "vendor", "name": "Siemens AG" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-13103", "cwe": { "id": "CWE-674", "name": "Uncontrolled Recursion" }, "notes": [ { "category": "other", "text": "Uncontrolled Recursion", "title": "CWE-674" }, { "category": "description", "text": "Multiple U-Boot versions, including DENX and Das U-Boot through 2019.07-rc4, contain vulnerabilities such as infinite recursion from crafted DOS partition tables causing crashes, alongside numerous CVEs from 2019-2020 affecting bootloader functionality and security.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2019-13103 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2019/cve-2019-13103.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2019-13103" }, { "cve": "CVE-2019-13104", "cwe": { "id": "CWE-191", "name": "Integer Underflow (Wrap or Wraparound)" }, "notes": [ { "category": "other", "text": "Integer Underflow (Wrap or Wraparound)", "title": "CWE-191" }, { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "U-Boot versions 2016.11-rc1 through 2019.07-rc4 contain multiple security vulnerabilities, including a memcpy() underflow and stack buffer overflow triggered by crafted ext4 filesystems, addressed by CVE-2019-13106 and CVE-2019-13104.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2019-13104 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2019/cve-2019-13104.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2019-13104" }, { "cve": "CVE-2019-13106", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple U-Boot versions from 2016.09 to 2019.07-rc4 contain critical security vulnerabilities including stack buffer overflow and memcpy() underflow related to crafted ext4 filesystems, enabling potential code execution.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2019-13106 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2019/cve-2019-13106.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2019-13106" }, { "cve": "CVE-2019-14192", "cwe": { "id": "CWE-191", "name": "Integer Underflow (Wrap or Wraparound)" }, "notes": [ { "category": "other", "text": "Integer Underflow (Wrap or Wraparound)", "title": "CWE-191" }, { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple security vulnerabilities, including an integer underflow causing unbounded memcpy in net_process_received_packet during UDP parsing, were addressed in Das U-Boot through version 2019.07, alongside fixes for network boot, USB keyboard, and hardware compatibility issues.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2019-14192 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2019/cve-2019-14192.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2019-14192" }, { "cve": "CVE-2019-14193", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple security vulnerabilities, including an unbounded memcpy in Das U-Boot's nfs_readlink_reply function before version 2019.07, were addressed across various updates fixing numerous CVEs and improving hardware compatibility and functionality.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2019-14193 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2019/cve-2019-14193.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2019-14193" }, { "cve": "CVE-2019-14194", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple security vulnerabilities, including an unbounded memcpy in the NFSv2 nfs_read_reply function, were addressed in Das U-Boot through updates fixing numerous CVEs and improving hardware support and network boot functionality.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2019-14194 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2019/cve-2019-14194.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2019-14194" }, { "cve": "CVE-2019-14195", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple security vulnerabilities including an unbounded memcpy in Das U-Boot's nfs_readlink_reply function prior to version 2019.07, along with various CVEs affecting network boot, USB, EFI, and descriptor handling, were addressed in recent U-Boot updates.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2019-14195 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2019/cve-2019-14195.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2019-14195" }, { "cve": "CVE-2019-14196", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple security vulnerabilities including unbounded memcpy in Das U-Boot up to version 2019.07 and various CVEs such as CVE-2019-13106, CVE-2019-11059, and CVE-2020-10648 were addressed in updates improving network boot, USB, and EFI support.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2019-14196 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2019/cve-2019-14196.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2019-14196" }, { "cve": "CVE-2019-14197", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "Multiple security vulnerabilities, including out-of-bounds read issues in the nfs_read_reply function, were addressed in Das U-Boot up to version 2019.07 through updates fixing numerous CVEs and improving hardware compatibility and functionality.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2019-14197 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2019/cve-2019-14197.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2019-14197" }, { "cve": "CVE-2019-14198", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple security vulnerabilities including an unbounded memcpy in Das U-Boot's nfs_read_reply function and various CVEs affecting network boot, USB, and EFI support on ARM platforms have been addressed in recent U-Boot updates.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2019-14198 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2019/cve-2019-14198.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2019-14198" }, { "cve": "CVE-2019-14199", "cwe": { "id": "CWE-191", "name": "Integer Underflow (Wrap or Wraparound)" }, "notes": [ { "category": "other", "text": "Integer Underflow (Wrap or Wraparound)", "title": "CWE-191" }, { "category": "description", "text": "Das U-Boot through version 2019.07 contains multiple security vulnerabilities including an integer underflow causing unbounded memcpy in UDP packet handling, with fixes addressing numerous CVEs from 2019 and 2020 alongside various functional improvements.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2019-14199 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2019/cve-2019-14199.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2019-14199" }, { "cve": "CVE-2019-14200", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Das U-Boot through version 2019.07 contains multiple security vulnerabilities including a stack-based buffer overflow in the nfs_handler reply helper function rpc_lookup_reply, with updates addressing numerous CVEs and various hardware and network boot issues.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2019-14200 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2019/cve-2019-14200.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2019-14200" }, { "cve": "CVE-2019-14201", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple security vulnerabilities, including stack-based buffer overflows in the nfs_lookup_reply function, were addressed in Das U-Boot through version 2019.07, alongside fixes for network boot, USB keyboard, and other hardware-related issues.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2019-14201 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2019/cve-2019-14201.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2019-14201" }, { "cve": "CVE-2019-14202", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple security vulnerabilities including stack-based buffer overflows in the nfs_readlink_reply function and various CVEs affecting Das U-Boot through version 2019.07 have been addressed in recent U-Boot updates.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2019-14202 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2019/cve-2019-14202.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2019-14202" }, { "cve": "CVE-2019-14203", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple security vulnerabilities including stack-based buffer overflows and various CVEs affecting Das U-Boot through version 2019.07 have been addressed, alongside fixes for network boot, USB keyboard, and hardware compatibility issues.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2019-14203 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2019/cve-2019-14203.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2019-14203" }, { "cve": "CVE-2019-14204", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple security vulnerabilities, including stack-based buffer overflows and various CVEs affecting Das U-Boot through version 2019.07, have been addressed in updates that also fix network boot, USB keyboard, and hardware compatibility issues.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2019-14204 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2019/cve-2019-14204.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2019-14204" }, { "cve": "CVE-2020-10648", "notes": [ { "category": "description", "text": "Multiple U-Boot updates through 2020 address numerous security vulnerabilities including verified boot bypass, arbitrary code execution, and signature verification flaws, alongside fixes for hardware compatibility and network boot issues.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2020-10648 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2020/cve-2020-10648.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2020-10648" }, { "cve": "CVE-2022-2347", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Heap-based Buffer Overflow", "title": "CWE-122" }, { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "The U-Boot DFU implementation contains a vulnerability where an unchecked USB DFU download length field allows a physical attacker to write beyond a heap buffer by specifying a wLength greater than 4096 bytes.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2022-2347 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2022/cve-2022-2347.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "baseScore": 7.7, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2022-2347" }, { "cve": "CVE-2022-30552", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" }, "notes": [ { "category": "other", "text": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "title": "CWE-120" }, { "category": "description", "text": "Multiple vulnerabilities in U-Boot, including buffer overflows and arbitrary out-of-bounds writes during IP packet defragmentation and i2c md command processing, can cause denial of service and memory corruption.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2022-30552 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2022/cve-2022-30552.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2022-30552" }, { "cve": "CVE-2022-30790", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple vulnerabilities in U-Boot, including buffer overflows and out-of-bounds writes (CVE-2022-30552, CVE-2022-30790, CVE-2022-30767, CVE-2022-34835), affect components like IP defragmentation and i2c md command, impacting EcoStruxure™ Panel Server Box and other systems.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2022-30790 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2022/cve-2022-30790.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2022-30790" }, { "cve": "CVE-2022-34835", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple vulnerabilities in U-Boot through 2022.07-rc5 include a stack-based buffer overflow in the 'i2c md' command due to an integer signedness error, heap overflow in squashfs, and out-of-bounds writes in IP defragmentation.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2022-34835 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2022/cve-2022-34835.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2022-34835" }, { "cve": "CVE-2023-3019", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple security vulnerabilities in QEMU, including heap buffer overflow, use-after-free, NULL pointer dereference, DMA reentrancy, and integer overflow, affect various components such as e1000e NIC emulation and Virtio, leading to denial of service, data disclosure, and potential code execution.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2023-3019 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2023/cve-2023-3019.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2023-3019" }, { "cve": "CVE-2023-27043", "cwe": { "id": "CWE-1286", "name": "Improper Validation of Syntactic Correctness of Input" }, "notes": [ { "category": "other", "text": "Improper Validation of Syntactic Correctness of Input", "title": "CWE-1286" }, { "category": "description", "text": "Multiple Python updates address critical vulnerabilities including incorrect parsing of email addresses with special characters (CVE-2023-27043), timing side channels in HMAC comparison, and other security flaws affecting versions up to 3.11.12 with extensive fixes and improvements.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2023-27043 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2023/cve-2023-27043.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2023-27043" }, { "cve": "CVE-2024-3447", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Heap-based Buffer Overflow", "title": "CWE-122" }, { "category": "description", "text": "This QEMU update addresses multiple critical security vulnerabilities including heap buffer overflows, use-after-free, NULL pointer dereferences, DMA reentrancy double free, and information leaks affecting various versions and NetApp products.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2024-3447 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-3447.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H", "baseScore": 6.0, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2024-3447" }, { "cve": "CVE-2024-4367", "cwe": { "id": "CWE-754", "name": "Improper Check for Unusual or Exceptional Conditions" }, "notes": [ { "category": "other", "text": "Improper Check for Unusual or Exceptional Conditions", "title": "CWE-754" }, { "category": "description", "text": "A missing type check in PDF.js font handling in Mozilla Firefox, Firefox ESR, and Thunderbird allows arbitrary JavaScript execution, affecting versions prior to Firefox 126, ESR 115.11, and Thunderbird 115.11.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2024-4367 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-4367.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2024-4367" }, { "cve": "CVE-2024-22365", "cwe": { "id": "CWE-277", "name": "Insecure Inherited Permissions" }, "notes": [ { "category": "other", "text": "Insecure Inherited Permissions", "title": "CWE-277" }, { "category": "description", "text": "Linux PAM versions prior to 1.6.0, including the pam_namespace module, contain local denial of service vulnerabilities due to improper handling of mkfifo and missing O_DIRECTORY flag in openat calls, with additional security flaws found in Red Hat OpenShift and IBM QRadar SIEM components.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2024-22365 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-22365.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2024-22365" }, { "cve": "CVE-2024-47704", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "SUSE Linux Enterprise 15 SP5 and SP6 kernels, including Confidential Computing, Azure, RT, and Micro variants, received extensive security and non-security updates addressing vulnerabilities across networking, memory, filesystems, device drivers, graphics, and multiple architectures.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2024-47704 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-47704.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2024-47704" }, { "cve": "CVE-2024-54017", "cwe": { "id": "CWE-334", "name": "Small Space of Random Values" }, "notes": [ { "category": "other", "text": "Small Space of Random Values", "title": "CWE-334" }, { "category": "description", "text": "Multiple versions of SIPROTEC 5 devices are vulnerable to brute force attacks on insufficiently random session identifiers, allowing unauthenticated remote attackers to gain unauthorized read access to limited web server information.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2024-54017 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-54017.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2024-54017" }, { "cve": "CVE-2024-57256", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "other", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "description", "text": "Multiple integer overflow vulnerabilities in Das U-Boot before 2025.01-rc1 affect ext4 symlink resolution, inode size handling, DHCP response processing, and memory allocation, potentially leading to memory corruption and arbitrary code execution.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2024-57256 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-57256.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2024-57256" }, { "cve": "CVE-2024-57258", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "other", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "description", "text": "Das U-Boot before version 2025.01-rc1 contains multiple integer overflow vulnerabilities in memory allocation, ext4 symlink resolution, and squashfs filesystem handling, potentially leading to crashes or arbitrary code execution.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2024-57258 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-57258.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2024-57258" }, { "cve": "CVE-2024-57924", "cwe": { "id": "CWE-617", "name": "Reachable Assertion" }, "notes": [ { "category": "other", "text": "Reachable Assertion", "title": "CWE-617" }, { "category": "description", "text": "Multiple security and non-security fixes were applied across various SUSE Linux Enterprise kernels, addressing numerous vulnerabilities in networking, filesystems, Bluetooth, and other kernel subsystems and drivers.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2024-57924 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-57924.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2024-57924" }, { "cve": "CVE-2024-58240", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple SUSE Linux Enterprise kernels, including versions 12, 15 (SP3 to SP7), Micro 6.x, and Azure variants, received extensive security updates addressing vulnerabilities in Bluetooth, networking, filesystems, USB, SCSI, memory management, and hardware drivers, alongside a Linux kernel TLS decryption refactor to improve processing correctness.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2024-58240 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-58240.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2024-58240" }, { "cve": "CVE-2025-0395", "cwe": { "id": "CWE-131", "name": "Incorrect Calculation of Buffer Size" }, "notes": [ { "category": "other", "text": "Incorrect Calculation of Buffer Size", "title": "CWE-131" }, { "category": "description", "text": "Multiple vulnerabilities including a buffer overflow in glibc's assert() function (CVE-2025-0395) affect GNU C Library versions 2.13 to 2.40 and various products like NetApp, Oracle Communications, and HPE Brocade, leading to potential DoS, data modification, and unauthorized access.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-0395 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-0395.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-0395" }, { "cve": "CVE-2025-3576", "cwe": { "id": "CWE-328", "name": "Use of Weak Hash" }, "notes": [ { "category": "other", "text": "Use of Weak Hash", "title": "CWE-328" }, { "category": "description", "text": "A vulnerability in MIT Kerberos 5 (CVE-2025-3576) allows spoofing of GSSAPI-protected messages via weaknesses in the RC4-HMAC-MD5 checksum, leading to disabling of weak ciphers like des3-cbc-sha1 and arcfour-hmac-md5 by default.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-3576 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-3576.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 5.9, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-3576" }, { "cve": "CVE-2025-6020", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "title": "CWE-22" }, { "category": "description", "text": "A set of vulnerabilities in linux-pam's pam_namespace module, including symlink and race condition flaws, allow local users to escalate privileges to root and cause information disclosure or denial of service, addressed by updates changing path handling and disabling user .pam_environment file reading.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-6020 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-6020.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-6020" }, { "cve": "CVE-2025-6021", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "other", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "other", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple vulnerabilities in libxml2, including integer overflows, stack buffer overflows, heap use-after-free, type confusion, and null pointer dereferences, can lead to denial of service or crashes, affecting versions up to 2.14.3 and related Oracle products.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-6021 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-6021.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-6021" }, { "cve": "CVE-2025-6052", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "other", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "description", "text": "Multiple vulnerabilities in GLib's GString, including integer overflow and buffer underflow (CVE-2025-6052, CVE-2025-4373), and a difficult-to-exploit Java SE 8u471-b50 JavaFX flaw can cause crashes, memory corruption, or partial denial of service.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-6052 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-6052.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-6052" }, { "cve": "CVE-2025-7425", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A heap use-after-free vulnerability in libxslt caused by attribute type flag corruption leads to memory corruption, crashes, and potential code execution, affecting libxml2, Oracle Java SE 8u471-b50, and Oracle Communications Cloud Native Core Certificate Management with CVSS scores up to 7.8.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-7425 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-7425.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-7425" }, { "cve": "CVE-2025-8916", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "other", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "description", "text": "Multiple vulnerabilities including excessive resource allocation, denial of service, injection flaws, and information disclosure affect Bouncy Castle Java libraries, Oracle Communications, Oracle Siebel CRM, Oracle Fusion Middleware, HPE Telco Service Activator, and various Ubuntu LTS versions.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-8916 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-8916.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-8916" }, { "cve": "CVE-2025-9230", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple OpenSSL vulnerabilities including CVE-2025-9230 cause out-of-bounds read/write in RFC 3211 KEK unwrap during CMS password-based decryption, potentially leading to crashes or code execution, with moderate severity and low exploit likelihood due to rare usage.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-9230 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-9230.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-9230" }, { "cve": "CVE-2025-9231", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "notes": [ { "category": "other", "text": "Covert Timing Channel", "title": "CWE-385" }, { "category": "other", "text": "Observable Timing Discrepancy", "title": "CWE-208" }, { "category": "description", "text": "Multiple vulnerabilities including a timing side-channel in the SM2 algorithm on 64-bit ARM platforms, memory handling flaws, and denial of service issues affect OpenSSL, Oracle PeopleSoft, Oracle JD Edwards, and NetApp products, with moderate severity in some cases.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-9231 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-9231.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-9231" }, { "cve": "CVE-2025-9232", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "Multiple OpenSSL vulnerabilities, including an out-of-bounds read in the HTTP client 'no_proxy' handling causing denial of service, affect various products such as Oracle Essbase, PeopleSoft, JD Edwards, SAP NetWeaver, and NetApp, with severity ranging from low to moderate.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-9232 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-9232.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.9, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-9232" }, { "cve": "CVE-2025-9714", "cwe": { "id": "CWE-606", "name": "Unchecked Input for Loop Condition" }, "notes": [ { "category": "other", "text": "Unchecked Input for Loop Condition", "title": "CWE-606" }, { "category": "other", "text": "Uncontrolled Recursion", "title": "CWE-674" }, { "category": "description", "text": "Libxml2 versions up to 2.9.14 contain infinite recursion vulnerabilities in exsltDynMapFunction and catalog parsing functions, causing stack exhaustion and local denial of service without arbitrary memory corruption.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-9714 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-9714.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-9714" }, { "cve": "CVE-2025-9820", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "description", "text": "GnuTLS versions prior to 3.8.11 contain buffer overflow vulnerabilities in gnutls_pkcs11_token_init and issues with malicious certificates and PKCS11 token labels, leading to denial of service and potential arbitrary code execution (CVE-2025-9820, CVE-2025-14831).", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-9820 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-9820.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 4.0, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-9820" }, { "cve": "CVE-2025-12659", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Heap-based Buffer Overflow", "title": "CWE-122" }, { "category": "description", "text": "A memory corruption vulnerability in applications parsing specially crafted IPT files may enable attackers to execute arbitrary code within the affected process.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-12659 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-12659.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-12659" }, { "cve": "CVE-2025-14831", "cwe": { "id": "CWE-407", "name": "Inefficient Algorithmic Complexity" }, "notes": [ { "category": "other", "text": "Inefficient Algorithmic Complexity", "title": "CWE-407" }, { "category": "description", "text": "GnuTLS versions prior to 3.8.12 contain vulnerabilities including CVE-2025-14831, causing denial of service via excessive CPU and memory use from malicious certificates with many name constraints and SANs, and CVE-2025-9820, related to crashes or potential code execution from PKCS11 token label mishandling.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-14831 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-14831.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-14831" }, { "cve": "CVE-2025-22871", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')" }, "notes": [ { "category": "other", "text": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "title": "CWE-444" }, { "category": "other", "text": "Dependency on Vulnerable Third-Party Component", "title": "CWE-1395" }, { "category": "description", "text": "A vulnerability in Go's net/http package allows acceptance of chunked data with bare LF line terminators, enabling HTTP request smuggling when combined with other misinterpreting servers, affecting multiple Go versions prior to 1.23.8 and 1.24.2.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-22871 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-22871.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-22871" }, { "cve": "CVE-2025-23143", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Multiple security vulnerabilities in the Linux kernel and AppArmor LSM affecting various architectures and subsystems were fixed, including null pointer dereferences and privilege escalation risks, to enhance system security and prevent local attacks.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-23143 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-23143.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-23143" }, { "cve": "CVE-2025-23160", "cwe": { "id": "CWE-401", "name": "Missing Release of Memory after Effective Lifetime" }, "notes": [ { "category": "other", "text": "Missing Release of Memory after Effective Lifetime", "title": "CWE-401" }, { "category": "description", "text": "Multiple SUSE Linux Enterprise kernels, including 15 SP6, 15 SP7, and Micro 6.x versions, received extensive security and non-security updates addressing vulnerabilities in networking, filesystems, drivers, CPU cache initialization, AMD processors, and various kernel subsystems.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-23160 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-23160.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-23160" }, { "cve": "CVE-2025-31257", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple security vulnerabilities including use-after-free flaws and memory corruption in WebKitGTK, Safari 18.5, and Oracle Java SE JavaFX were fixed through improved memory handling and updates addressing crashes, data exfiltration, and remote code execution risks.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31257 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-31257.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-31257" }, { "cve": "CVE-2025-37931", "notes": [ { "category": "description", "text": "Multiple SUSE Linux Enterprise and Micro kernel versions received extensive security updates addressing numerous vulnerabilities across CPU cache initialization, AMD processors, filesystems including btrfs, drivers, and various kernel subsystems, alongside many non-security bug fixes and improvements.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-37931 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-37931.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-37931" }, { "cve": "CVE-2025-37968", "cwe": { "id": "CWE-667", "name": "Improper Locking" }, "notes": [ { "category": "other", "text": "Improper Locking", "title": "CWE-667" }, { "category": "description", "text": "Multiple updates to SUSE Linux Enterprise kernels, including 15 SP6, SP7, Micro, Azure, Confidential Computing, and RT variants, addressed numerous security vulnerabilities and bugs across diverse subsystems such as media, networking, tracing, filesystems, drivers, and CPU architectures including AMD processors and the VMSCAPE flaw.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-37968 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-37968.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-37968" }, { "cve": "CVE-2025-38322", "notes": [ { "category": "description", "text": "Multiple security vulnerabilities and non-security bugs affecting various Linux kernel subsystems, including CPU cache initialization flaws, AMD processor data leakage, and a Linux kernel crash on RaptorLake CPUs, were fixed across SUSE Linux Enterprise and Micro kernel versions.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38322 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38322.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38322" }, { "cve": "CVE-2025-38347", "notes": [ { "category": "description", "text": "Multiple security vulnerabilities in the Linux kernel, including a f2fs filesystem inode sanity check fix, CPU cache initialization flaws, AMD processor data leakage, and the VMSCAPE branch predictor isolation issue, were addressed across various subsystems and architectures.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38347 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38347.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38347" }, { "cve": "CVE-2025-38491", "cwe": { "id": "CWE-667", "name": "Improper Locking" }, "notes": [ { "category": "other", "text": "Improper Locking", "title": "CWE-667" }, { "category": "description", "text": "Multiple security vulnerabilities in the Linux kernel, including atomicity issues in the mptcp subsystem, CPU cache initialization flaws, and AMD processor data leaks, were fixed across various SUSE Linux Enterprise and Micro kernel versions affecting numerous subsystems and architectures.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38491 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38491.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38491" }, { "cve": "CVE-2025-38502", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "A comprehensive Linux kernel update fixed multiple critical vulnerabilities including out-of-bounds access in cgroup local storage via BPF, AppArmor LSM flaws, AMD CPU microcode loading issues, and the VMSCAPE branch predictor isolation vulnerability across various architectures and subsystems.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38502 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38502.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H/E:U", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38502" }, { "cve": "CVE-2025-38552", "notes": [ { "category": "description", "text": "Multiple security vulnerabilities in the Linux kernel, including race conditions in the mptcp subsystem, CPU cache initialization flaws, and AMD processor data leaks, were fixed across various SUSE Linux Enterprise and Micro kernel versions.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38552 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38552.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38552" }, { "cve": "CVE-2025-38614", "cwe": { "id": "CWE-674", "name": "Uncontrolled Recursion" }, "notes": [ { "category": "other", "text": "Uncontrolled Recursion", "title": "CWE-674" }, { "category": "description", "text": "Multiple security vulnerabilities, including the VMSCAPE branch predictor isolation flaw and CPU cache initialization issues, were addressed in various Linux kernel versions across SUSE Linux Enterprise and Linux Micro products, with fixes spanning numerous architectures, subsystems, and drivers.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38614 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38614.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38614" }, { "cve": "CVE-2025-38670", "notes": [ { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel architectures, subsystems, and drivers—including arm64 stack switching, CPU cache initialization, AMD processor data leakage, and the VMSCAPE branch predictor flaw—were fixed across SUSE Linux Enterprise and Micro kernels.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38670 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38670.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38670" }, { "cve": "CVE-2025-38676", "cwe": { "id": "CWE-805", "name": "Buffer Access with Incorrect Length Value" }, "notes": [ { "category": "other", "text": "Buffer Access with Incorrect Length Value", "title": "CWE-805" }, { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple security vulnerabilities, including stack buffer overflows, CPU cache initialization flaws, and the VMSCAPE branch predictor isolation issue, were fixed across various Linux kernel components and SUSE Linux Enterprise products to enhance system security.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38676 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38676.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38676" }, { "cve": "CVE-2025-38677", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "A comprehensive Linux kernel update fixed multiple security vulnerabilities including out-of-boundary access in the f2fs filesystem, CPU cache initialization flaws, AMD processor data leakage, and the VMSCAPE branch predictor isolation issue across various architectures and subsystems.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38677 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38677.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38677" }, { "cve": "CVE-2025-38679", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel subsystems, including the media: venus driver, CPU cache initialization, AMD processors, and numerous drivers, were addressed through extensive patches in SUSE Linux Enterprise and Micro kernels.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38679 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38679.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38679" }, { "cve": "CVE-2025-38680", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "Multiple security vulnerabilities affecting the Linux kernel, including AMD processors, uvcvideo driver, AppArmor module, and branch predictor isolation (VMSCAPE), were fixed across various SUSE Linux Enterprise and Micro kernel versions to address out-of-bounds reads, privilege escalation, data leakage, and system integrity issues.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38680 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38680.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38680" }, { "cve": "CVE-2025-38681", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" }, "notes": [ { "category": "other", "text": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "title": "CWE-362" }, { "category": "other", "text": "Race Condition within a Thread", "title": "CWE-366" }, { "category": "description", "text": "Multiple security vulnerabilities affecting AMD processors and various Linux kernel subsystems, including a race condition in ptdump and the VMSCAPE flaw in branch predictor isolation, were addressed across SUSE Linux Enterprise and Micro kernels from 15 SP6 to 16.0 and 6.2.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38681 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38681.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38681" }, { "cve": "CVE-2025-38683", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "other", "text": "Missing Synchronization", "title": "CWE-820" }, { "category": "description", "text": "Multiple Linux kernel updates for SUSE Linux Enterprise and Micro versions address numerous security vulnerabilities and non-security bugs across various subsystems including networking, filesystems, drivers, AMD processor issues, and kernel panic fixes.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38683 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38683.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38683" }, { "cve": "CVE-2025-38684", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel architectures and subsystems, including a NULL pointer dereference in net/sched ets, CPU cache initialization flaws, AMD processor data leakage, and the VMSCAPE branch predictor isolation issue, were fixed across SUSE Linux Enterprise and Micro kernel versions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38684 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38684.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38684" }, { "cve": "CVE-2025-38685", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple security vulnerabilities affecting the Linux kernel across various SUSE Linux Enterprise versions and architectures were fixed, including issues in fbdev, Bluetooth, networking, filesystems, device drivers, AMD processors, virtualization, and memory management.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38685 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38685.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38685" }, { "cve": "CVE-2025-38687", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" }, "notes": [ { "category": "other", "text": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "title": "CWE-362" }, { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel subsystems, architectures, and AMD processors—including race conditions, use-after-free errors, CPU cache initialization flaws, and branch predictor isolation issues—were fixed across SUSE Linux Enterprise and Micro kernel versions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38687 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38687.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38687" }, { "cve": "CVE-2025-38691", "cwe": { "id": "CWE-908", "name": "Use of Uninitialized Resource" }, "notes": [ { "category": "other", "text": "Use of Uninitialized Resource", "title": "CWE-908" }, { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel subsystems and architectures, including AMD CPU flaws, pNFS layout issues, and the VMSCAPE branch predictor isolation flaw, were addressed across SUSE Linux Enterprise and Micro kernel versions with extensive patches.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38691 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38691.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38691" }, { "cve": "CVE-2025-38693", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Multiple critical security vulnerabilities affecting AMD processors, Linux kernel subsystems, and the VMSCAPE flaw in branch predictor isolation were fixed across SUSE Linux Enterprise and Micro kernels, addressing issues like null pointer dereferences, race conditions, use-after-free, and memory corruption.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38693 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38693.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38693" }, { "cve": "CVE-2025-38694", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Multiple critical security vulnerabilities affecting AMD processors and various Linux kernel subsystems—including memory management, networking, USB, SCSI, and CPU cache initialization—were addressed across SUSE Linux Enterprise and Micro kernel versions with numerous CVE fixes.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38694 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38694.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38694" }, { "cve": "CVE-2025-38695", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Multiple security vulnerabilities affecting AMD processors, Linux kernel subsystems, and drivers—including a null pointer dereference in the SCSI lpfc driver and the VMSCAPE branch predictor isolation flaw—were addressed across various SUSE Linux Enterprise and Micro kernel versions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38695 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38695.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38695" }, { "cve": "CVE-2025-38696", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Multiple security vulnerabilities affecting various CPU architectures and Linux kernel subsystems, including MIPS stack handling, CPU cache initialization, AMD processor data leakage, and branch predictor isolation (VMSCAPE), were fixed to prevent crashes, privilege escalation, and data leaks.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38696 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38696.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38696" }, { "cve": "CVE-2025-38697", "cwe": { "id": "CWE-129", "name": "Improper Validation of Array Index" }, "notes": [ { "category": "other", "text": "Improper Validation of Array Index", "title": "CWE-129" }, { "category": "description", "text": "Multiple security vulnerabilities in the Linux kernel, including a critical out-of-bounds access flaw in the jfs filesystem and a branch predictor isolation issue (VMSCAPE), were fixed across various SUSE Linux Enterprise and Micro kernel versions affecting numerous architectures and subsystems.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38697 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38697.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38697" }, { "cve": "CVE-2025-38698", "notes": [ { "category": "description", "text": "Multiple updates to the Linux kernel and SUSE Linux Enterprise products addressed numerous critical security vulnerabilities affecting AMD processors, various kernel subsystems, drivers, and filesystems, including fixes for data leakage, memory corruption, and branch predictor isolation flaws.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38698 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38698.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38698" }, { "cve": "CVE-2025-38699", "cwe": { "id": "CWE-415", "name": "Double Free" }, "notes": [ { "category": "other", "text": "Double Free", "title": "CWE-415" }, { "category": "description", "text": "Multiple Linux kernel updates from SUSE and others addressed critical vulnerabilities including a double-free flaw in the scsi bfa driver, CPU cache initialization issues on AMD processors, the VMSCAPE vulnerability, race conditions, and use-after-free bugs across various subsystems and architectures.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38699 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38699.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38699" }, { "cve": "CVE-2025-38700", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Multiple Linux kernel updates from SUSE and others address numerous security vulnerabilities across various architectures, subsystems, and drivers, including fixes for AMD CPU cache issues, iSER setup panics, and VMSCAPE branch predictor flaws.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38700 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38700.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38700" }, { "cve": "CVE-2025-38701", "cwe": { "id": "CWE-617", "name": "Reachable Assertion" }, "notes": [ { "category": "other", "text": "Reachable Assertion", "title": "CWE-617" }, { "category": "description", "text": "Multiple Linux kernel updates from SUSE and others address numerous security vulnerabilities including a branch predictor isolation flaw (VMSCAPE), CPU cache initialization issues, AMD processor data leaks, and ext4 filesystem error handling improvements.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38701 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38701.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38701" }, { "cve": "CVE-2025-38702", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel subsystems, including fbdev, memory management, networking, schedulers, and hardware drivers, were addressed across SUSE Linux Enterprise and Micro kernel versions to prevent buffer overflows, data leakage, and privilege escalation.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38702 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38702.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38702" }, { "cve": "CVE-2025-38706", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Multiple security vulnerabilities affecting the Linux kernel, including null pointer dereference, CPU cache initialization flaws, AMD processor data leakage, and branch predictor isolation (VMSCAPE), were discovered and fixed across various SUSE Linux Enterprise and Micro kernel versions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38706 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38706.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38706" }, { "cve": "CVE-2025-38707", "notes": [ { "category": "description", "text": "A comprehensive Linux kernel update addressed multiple security vulnerabilities across various subsystems and architectures, including fixes for the NTFS3 file system, CPU cache initialization flaws, AMD processor data leakage, and the VMSCAPE branch predictor isolation issue.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38707 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38707.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38707" }, { "cve": "CVE-2025-38708", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "A comprehensive Linux kernel update addressed multiple security vulnerabilities across various architectures and subsystems, including fixes for DRBD use-after-free, AMD CPU cache flaws, AppArmor LSM issues, and the VMSCAPE branch predictor isolation vulnerability.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38708 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38708.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38708" }, { "cve": "CVE-2025-38711", "cwe": { "id": "CWE-667", "name": "Improper Locking" }, "notes": [ { "category": "other", "text": "Improper Locking", "title": "CWE-667" }, { "category": "description", "text": "Multiple security vulnerabilities in the Linux kernel affecting various architectures, drivers, and subsystems—including a deadlock in SMB server, AMD CPU issues, SEV-SNP memory integrity flaws, and the VMSCAPE branch predictor isolation vulnerability—were fixed to enhance system security.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38711 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38711.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38711" }, { "cve": "CVE-2025-38712", "cwe": { "id": "CWE-617", "name": "Reachable Assertion" }, "notes": [ { "category": "other", "text": "Reachable Assertion", "title": "CWE-617" }, { "category": "description", "text": "Multiple security vulnerabilities, including the VMSCAPE branch predictor isolation flaw, CPU cache initialization issues, and memory management bugs, were fixed across various Linux kernel versions and SUSE Enterprise products affecting numerous architectures and drivers.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38712 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38712.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38712" }, { "cve": "CVE-2025-38713", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "Multiple security vulnerabilities including slab-out-of-bounds reads, use-after-free, race conditions, memory leaks, CPU cache initialization flaws, AMD processor data leakage, and the critical VMSCAPE branch predictor isolation flaw were fixed across various Linux kernel subsystems in SUSE Linux Enterprise and other distributions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38713 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38713.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38713" }, { "cve": "CVE-2025-38714", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "Multiple security vulnerabilities, including a slab-out-of-bounds issue in the Linux kernel's hfsplus_bnode_read() function and the VMSCAPE flaw affecting branch predictor isolation, were fixed across various SUSE Linux Enterprise and Linux kernel versions impacting numerous subsystems and architectures.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38714 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38714.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H/E:U", "baseScore": 9.0, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38714" }, { "cve": "CVE-2025-38715", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "Multiple critical security vulnerabilities affecting AMD processors and various Linux kernel subsystems including HFS filesystem, coresight, sched, usb, scsi, KVM, netfilter, and others were fixed across SUSE Linux Enterprise and Micro kernels to prevent memory access violations, data leakage, and branch predictor isolation flaws.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38715 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38715.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38715" }, { "cve": "CVE-2025-38721", "cwe": { "id": "CWE-772", "name": "Missing Release of Resource after Effective Lifetime" }, "notes": [ { "category": "other", "text": "Missing Release of Resource after Effective Lifetime", "title": "CWE-772" }, { "category": "description", "text": "Multiple security vulnerabilities including a refcount leak in netfilter, CPU cache initialization flaws, AMD processor data leakage, and the VMSCAPE branch predictor isolation issue were fixed across various Linux kernel versions and SUSE Enterprise products.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38721 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38721.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38721" }, { "cve": "CVE-2025-38723", "notes": [ { "category": "description", "text": "A vulnerability in the Linux kernel's LoongArch BPF implementation caused incorrect jump offset calculations in tail calls, leading to soft lockups, which was fixed by correcting the JIT context initialization and offset calculation.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38723 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38723.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38723" }, { "cve": "CVE-2025-38724", "cwe": { "id": "CWE-367", "name": "Time-of-check Time-of-use (TOCTOU) Race Condition" }, "notes": [ { "category": "other", "text": "Time-of-check Time-of-use (TOCTOU) Race Condition", "title": "CWE-367" }, { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel subsystems, including use-after-free, race conditions, CPU cache flaws, and branch predictor isolation issues, were addressed across SUSE Linux Enterprise and Micro kernels with extensive patches.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38724 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38724.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38724" }, { "cve": "CVE-2025-38725", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel versions, including SUSE Enterprise and Micro kernels, were addressed, covering issues in drivers, filesystems, CPU architectures (notably AMD), and virtualization subsystems such as the VMSCAPE flaw.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38725 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38725.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38725" }, { "cve": "CVE-2025-38727", "cwe": { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition ('Infinite Loop')" }, "notes": [ { "category": "other", "text": "Loop with Unreachable Exit Condition ('Infinite Loop')", "title": "CWE-835" }, { "category": "description", "text": "Multiple security vulnerabilities and bugs affecting Linux kernel components including netlink, schedulers, drivers, memory management, and GPU subsystems were fixed across various SUSE Linux Enterprise and Micro kernel versions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38727 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38727.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38727" }, { "cve": "CVE-2025-38728", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "Multiple security vulnerabilities affecting the Linux kernel, including slab out-of-bounds in the smb3 subsystem, CPU cache initialization flaws, and AMD processor data leakage, were fixed across various SUSE Linux Enterprise versions and NetApp products.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38728 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38728.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38728" }, { "cve": "CVE-2025-38729", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple security vulnerabilities affecting the Linux kernel and AMD processors across various architectures, drivers, and subsystems were addressed, including issues like race conditions, memory leaks, use-after-free bugs, CPU cache initialization flaws, and branch predictor isolation (VMSCAPE).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38729 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38729.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38729" }, { "cve": "CVE-2025-38732", "cwe": { "id": "CWE-911", "name": "Improper Update of Reference Count" }, "notes": [ { "category": "other", "text": "Improper Update of Reference Count", "title": "CWE-911" }, { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel versions and SUSE Linux Enterprise products, including issues like destination refcount leaks, CPU cache initialization flaws, AMD processor data leakage, and the VMSCAPE branch predictor isolation flaw, were addressed with extensive patches.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38732 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38732.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38732" }, { "cve": "CVE-2025-38735", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Multiple security vulnerabilities affecting SUSE Linux Enterprise kernels, including AMD processors, AppArmor LSM, and various kernel subsystems and drivers, were fixed to prevent kernel crashes, privilege escalation, data leaks, and integrity loss.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38735 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38735.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38735" }, { "cve": "CVE-2025-38736", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "Multiple security fixes were applied across various SUSE Linux Enterprise and Micro kernel versions, addressing vulnerabilities such as race conditions, use-after-free bugs, memory leaks, null pointer dereferences, and a specific fix in the Linux kernel asix_devices USB network driver for PHY address masking.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-38736 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38736.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-38736" }, { "cve": "CVE-2025-39673", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" }, "notes": [ { "category": "other", "text": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "title": "CWE-362" }, { "category": "description", "text": "Multiple security vulnerabilities and race conditions affecting various Linux kernel subsystems, including ppp, scsi, net, drm, ACPI, and critical AMD CPU and SEV-SNP memory integrity issues, were fixed across SUSE Linux Enterprise and Micro kernels.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39673 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39673.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39673" }, { "cve": "CVE-2025-39675", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Multiple security vulnerabilities affecting the Linux kernel and AMD processors across numerous subsystems and architectures, including null pointer dereferences, CPU cache initialization flaws, data leakage, and branch predictor isolation issues, were identified and addressed in various SUSE Linux Enterprise and Micro kernel updates.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39675 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39675.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39675" }, { "cve": "CVE-2025-39676", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "other", "text": "Unexpected Status Code or Return Value", "title": "CWE-394" }, { "category": "description", "text": "Multiple Linux kernel updates, including SUSE Linux Enterprise and Micro versions, addressed numerous critical security vulnerabilities across various subsystems, drivers, and architectures, such as CPU cache initialization, AMD processor data leakage, and the VMSCAPE flaw involving branch predictor isolation.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39676 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39676.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39676" }, { "cve": "CVE-2025-39681", "cwe": { "id": "CWE-369", "name": "Divide By Zero" }, "notes": [ { "category": "other", "text": "Divide By Zero", "title": "CWE-369" }, { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel architectures, subsystems, and drivers—including CPU cache initialization, AMD processor data leakage, and the VMSCAPE branch predictor flaw—were fixed across SUSE Linux Enterprise and Micro kernel versions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39681 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39681.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39681" }, { "cve": "CVE-2025-39682", "notes": [ { "category": "description", "text": "Multiple SUSE Linux Enterprise kernel updates address numerous security vulnerabilities including buffer overflows, use-after-free, race conditions, TLS zero-length record handling, malicious packet rejection, and constant-time MAC comparison across various subsystems.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39682 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39682.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39682" }, { "cve": "CVE-2025-39683", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "Multiple Linux kernel updates from SUSE and others addressed numerous security vulnerabilities including KASAN slab-out-of-bounds, CPU cache initialization flaws, AMD processor data leakage, VMSCAPE branch predictor isolation, and local privilege escalation in AppArmor LSM across various kernel subsystems and architectures.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39683 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39683.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39683" }, { "cve": "CVE-2025-39684", "cwe": { "id": "CWE-908", "name": "Use of Uninitialized Resource" }, "notes": [ { "category": "other", "text": "Use of Uninitialized Resource", "title": "CWE-908" }, { "category": "description", "text": "Multiple security vulnerabilities affecting the Linux kernel, including AMD processors, SEV-SNP guest memory, and the VMSCAPE branch predictor flaw, were addressed across various SUSE Linux Enterprise and Micro kernel versions with extensive fixes in numerous subsystems and drivers.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39684 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39684.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39684" }, { "cve": "CVE-2025-39685", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "Multiple security vulnerabilities affecting AMD processors and various Linux kernel subsystems, including drivers, filesystems, networking, and virtualization components, were fixed across SUSE Linux Enterprise and Micro kernels, addressing issues like race conditions, use-after-free, memory leaks, and privilege escalation.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39685 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39685.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39685" }, { "cve": "CVE-2025-39686", "notes": [ { "category": "description", "text": "Multiple critical security vulnerabilities affecting various Linux kernel versions and subsystems, including AMD processor flaws, race conditions, use-after-free bugs, and the VMSCAPE vulnerability, were fixed across SUSE Linux Enterprise and Linux Micro kernels.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39686 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39686.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39686" }, { "cve": "CVE-2025-39687", "notes": [ { "category": "description", "text": "Multiple security vulnerabilities in the Linux kernel affecting various CPU architectures, drivers, and subsystems—including the iio light as73211 driver and the VMSCAPE branch predictor isolation flaw—were fixed to prevent data leakage and memory corruption.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39687 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39687.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39687" }, { "cve": "CVE-2025-39689", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple security vulnerabilities in the Linux kernel affecting various CPU architectures, drivers, and subsystems—including ftrace use-after-free bugs, AMD processor data leakage, SEV-SNP memory integrity, and VMSCAPE branch predictor isolation—were fixed across SUSE Linux Enterprise and other distributions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39689 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39689.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39689" }, { "cve": "CVE-2025-39691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple security vulnerabilities, including use-after-free bugs, branch predictor isolation flaws (VMSCAPE), and CPU cache initialization issues, were fixed across various Linux kernel subsystems and architectures, affecting SUSE Linux Enterprise and Micro products.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39691 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39691.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39691" }, { "cve": "CVE-2025-39692", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Multiple Linux kernel security updates addressed numerous vulnerabilities including improper CPU cache initialization affecting AMD processors and SEV-SNP guest memory, alongside fixes for local privilege escalation in AppArmor and kernel subsystem issues.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39692 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39692.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39692" }, { "cve": "CVE-2025-39693", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel subsystems, including drm/amd/display, AMD CPU cache, AppArmor LSM, and virtualization branch predictor isolation (VMSCAPE), were fixed across SUSE Linux Enterprise and Micro kernel versions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39693 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39693.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39693" }, { "cve": "CVE-2025-39694", "cwe": { "id": "CWE-1285", "name": "Improper Validation of Specified Index, Position, or Offset in Input" }, "notes": [ { "category": "other", "text": "Improper Validation of Specified Index, Position, or Offset in Input", "title": "CWE-1285" }, { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel subsystems, including s390/sclp, AMD CPU cache initialization, AppArmor, and others, were fixed across SUSE Linux Enterprise and Micro products, addressing issues such as improper memory access and data leakage.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39694 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39694.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39694" }, { "cve": "CVE-2025-39697", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" }, "notes": [ { "category": "other", "text": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "title": "CWE-362" }, { "category": "description", "text": "Multiple security vulnerabilities, including race conditions, use-after-free flaws, and branch predictor isolation issues, were identified and fixed across various Linux kernel subsystems and architectures, notably affecting SUSE Linux Enterprise and Micro distributions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39697 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39697.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39697" }, { "cve": "CVE-2025-39701", "cwe": { "id": "CWE-1025", "name": "Comparison Using Wrong Factors" }, "notes": [ { "category": "other", "text": "Comparison Using Wrong Factors", "title": "CWE-1025" }, { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel components, including ACPI's pfr_update driver, AMD processors, and SEV-SNP guest memory integrity, were discovered and addressed across SUSE Linux Enterprise and Micro kernel versions with extensive fixes.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39701 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39701.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39701" }, { "cve": "CVE-2025-39702", "cwe": { "id": "CWE-208", "name": "Observable Timing Discrepancy" }, "notes": [ { "category": "other", "text": "Observable Timing Discrepancy", "title": "CWE-208" }, { "category": "other", "text": "Observable Discrepancy", "title": "CWE-203" }, { "category": "description", "text": "Multiple severe security vulnerabilities affecting various Linux kernel subsystems, including ipv6: sr MAC timing attacks, CPU cache initialization, AMD processor data leakage, and the VMSCAPE branch predictor isolation flaw, were fixed across SUSE Linux Enterprise and Micro kernels.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39702 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39702.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39702" }, { "cve": "CVE-2025-39703", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "other", "text": "Improper Validation of Syntactic Correctness of Input", "title": "CWE-1286" }, { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel subsystems, including HSR network protocol, CPU cache initialization, AMD processor data leakage, and branch predictor isolation (VMSCAPE), were fixed across SUSE Linux Enterprise and Micro kernels with extensive updates.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39703 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39703.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39703" }, { "cve": "CVE-2025-39706", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Multiple Linux kernel updates from SUSE address numerous security vulnerabilities affecting AMD processors, various kernel subsystems, drivers, and architectures, including fixes for KFD debugfs, AppArmor LSM, and SEV-SNP guest memory issues.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39706 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39706.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39706" }, { "cve": "CVE-2025-39709", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel subsystems and AMD processors, including critical CPU cache initialization flaws, data leakage, and the VMSCAPE branch predictor isolation issue, were addressed through extensive updates across SUSE Linux Enterprise and Micro kernels.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39709 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39709.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39709" }, { "cve": "CVE-2025-39710", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "Multiple security vulnerabilities and stability issues affecting various Linux kernel subsystems, architectures, and AMD processors were addressed across SUSE Linux Enterprise and Micro kernels, including fixes for the media: venus driver and the VMSCAPE vulnerability.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39710 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39710.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39710" }, { "cve": "CVE-2025-39713", "cwe": { "id": "CWE-367", "name": "Time-of-check Time-of-use (TOCTOU) Race Condition" }, "notes": [ { "category": "other", "text": "Time-of-check Time-of-use (TOCTOU) Race Condition", "title": "CWE-367" }, { "category": "description", "text": "Multiple security vulnerabilities and bugs affecting various Linux kernel components, including AMD CPU data leakage, race conditions, and branch predictor isolation flaws, were fixed across SUSE Linux Enterprise and Linux kernel versions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39713 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39713.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39713" }, { "cve": "CVE-2025-39714", "notes": [ { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel subsystems, CPU architectures including AMD processors, and drivers were fixed across SUSE Linux Enterprise and Micro kernels, including a critical VMSCAPE flaw involving branch predictor isolation between guest VMs and hypervisors.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39714 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39714.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39714" }, { "cve": "CVE-2025-39715", "notes": [ { "category": "description", "text": "Multiple security vulnerabilities in the Linux kernel affecting various architectures and subsystems, including parisc, CPU cache initialization, AMD processor data leakage, and AppArmor, were addressed to prevent unauthorized access and privilege escalation.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39715 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39715.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39715" }, { "cve": "CVE-2025-39716", "notes": [ { "category": "description", "text": "Multiple security vulnerabilities in the Linux kernel affecting various architectures, including parisc and AMD processors, were fixed, addressing issues such as improper CPU cache initialization, data leakage, and privilege escalation.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39716 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39716.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39716" }, { "cve": "CVE-2025-39718", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple security vulnerabilities in the Linux kernel, including vsock/virtio SKB overflow, CPU cache initialization flaws, and AMD processor data leakage, were addressed across various SUSE Linux Enterprise and Micro kernel versions with extensive security and stability updates.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39718 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39718.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "baseScore": 7.6, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39718" }, { "cve": "CVE-2025-39719", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "Multiple security vulnerabilities affecting AMD processors and various Linux kernel subsystems, including out-of-bounds array access in the bno055 IMU driver and improper CPU cache initialization, were addressed in updates to SUSE Linux Enterprise and Micro kernels.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39719 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39719.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39719" }, { "cve": "CVE-2025-39724", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" }, "notes": [ { "category": "other", "text": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "title": "CWE-362" }, { "category": "description", "text": "Multiple security vulnerabilities affecting Linux kernel subsystems, including AMD CPU data leakage, SEV-SNP guest memory integrity, and the VMSCAPE branch predictor flaw, were fixed across various SUSE Linux Enterprise and Micro kernel versions.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39724 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39724.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39724" }, { "cve": "CVE-2025-39736", "cwe": { "id": "CWE-667", "name": "Improper Locking" }, "notes": [ { "category": "other", "text": "Improper Locking", "title": "CWE-667" }, { "category": "other", "text": "Deadlock", "title": "CWE-833" }, { "category": "description", "text": "The Linux kernel addressed multiple security vulnerabilities across various architectures and subsystems, including AMD CPU cache flaws, the VMSCAPE branch predictor isolation issue, and deadlock fixes related to kmemleak_lock and netpoll interactions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39736 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39736.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39736" }, { "cve": "CVE-2025-39737", "cwe": { "id": "CWE-401", "name": "Missing Release of Memory after Effective Lifetime" }, "notes": [ { "category": "other", "text": "Missing Release of Memory after Effective Lifetime", "title": "CWE-401" }, { "category": "description", "text": "This Linux kernel update addresses multiple security vulnerabilities across various architectures and subsystems, including AMD CPU data leakage, SEV-SNP memory integrity flaws, VMSCAPE branch predictor isolation issues, and a soft lockup fix in kmemleak cleanup.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39737 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39737.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39737" }, { "cve": "CVE-2025-39738", "notes": [ { "category": "description", "text": "Multiple security vulnerabilities affecting the Linux kernel, including btrfs subvolume relocation, CPU cache initialization, AMD processor data leakage, and the VMSCAPE branch predictor isolation flaw, were fixed across various SUSE Linux Enterprise and Micro kernel versions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39738 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39738.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39738" }, { "cve": "CVE-2025-39742", "cwe": { "id": "CWE-369", "name": "Divide By Zero" }, "notes": [ { "category": "other", "text": "Divide By Zero", "title": "CWE-369" }, { "category": "description", "text": "Multiple Linux kernel updates from SUSE Linux Enterprise and others address a wide range of security vulnerabilities including divide-by-zero errors, race conditions, use-after-free, null pointer dereferences, information leaks, and CPU cache initialization flaws across various subsystems and architectures.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39742 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39742.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39742" }, { "cve": "CVE-2025-39743", "notes": [ { "category": "description", "text": "Multiple critical security vulnerabilities affecting Linux kernel subsystems, drivers, filesystems, and architectures—including the VMSCAPE flaw and CPU cache and AMD processor issues—were fixed across SUSE Linux Enterprise and Micro product lines.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39743 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39743.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39743" }, { "cve": "CVE-2025-39749", "notes": [ { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel architectures, subsystems, and drivers—including data races in RCU, branch predictor isolation (VMSCAPE), AMD processor data leakage, and AppArmor flaws—were addressed through extensive patches across SUSE Linux Enterprise and Micro kernel versions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39749 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39749.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39749" }, { "cve": "CVE-2025-39752", "cwe": { "id": "CWE-364", "name": "Signal Handler Race Condition" }, "notes": [ { "category": "other", "text": "Signal Handler Race Condition", "title": "CWE-364" }, { "category": "description", "text": "A comprehensive Linux kernel update addresses multiple security vulnerabilities including ARM rockchip SMP initialization hangs, CPU cache initialization flaws, AMD processor data leaks, AppArmor LSM privilege escalations, and the VMSCAPE branch predictor isolation issue across various architectures and subsystems.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39752 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39752.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39752" }, { "cve": "CVE-2025-39756", "cwe": { "id": "CWE-401", "name": "Missing Release of Memory after Effective Lifetime" }, "notes": [ { "category": "other", "text": "Missing Release of Memory after Effective Lifetime", "title": "CWE-401" }, { "category": "description", "text": "Multiple Linux kernel updates from SUSE Linux Enterprise and related distributions address critical security vulnerabilities across file descriptor allocation, networking, device drivers, CPU cache initialization, AMD processor data leakage, and branch predictor isolation flaws affecting various architectures and subsystems.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39756 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39756.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39756" }, { "cve": "CVE-2025-39757", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "Multiple Linux kernel updates, including SUSE Enterprise and Micro versions, addressed numerous security vulnerabilities such as memory leaks, race conditions, use-after-free bugs, AMD processor data leakage, and a VM branch predictor isolation flaw (VMSCAPE).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39757 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39757.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39757" }, { "cve": "CVE-2025-39759", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" }, "notes": [ { "category": "other", "text": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "title": "CWE-362" }, { "category": "description", "text": "Multiple security vulnerabilities and race conditions in the Linux kernel, including btrfs qgroup use-after-free and AMD SEV-SNP guest memory issues, were fixed across various SUSE Linux Enterprise and Micro kernel versions affecting numerous subsystems and drivers.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39759 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39759.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39759" }, { "cve": "CVE-2025-39760", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "Multiple security vulnerabilities affecting the Linux kernel and AMD processors across various architectures, drivers, and subsystems, including USB, Bluetooth, and virtualization, were addressed in updates for SUSE Linux Enterprise and related distributions.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39760 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39760.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39760" }, { "cve": "CVE-2025-39766", "notes": [ { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel subsystems, architectures, and drivers—including CPU cache initialization flaws, AMD data leakage, and the VMSCAPE branch predictor isolation issue—were addressed through extensive updates across SUSE Linux Enterprise and Micro kernels.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39766 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39766.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39766" }, { "cve": "CVE-2025-39770", "cwe": { "id": "CWE-573", "name": "Improper Following of Specification by Caller" }, "notes": [ { "category": "other", "text": "Improper Following of Specification by Caller", "title": "CWE-573" }, { "category": "description", "text": "Multiple security vulnerabilities and bugs affecting various Linux kernel versions, including SUSE Linux Enterprise and Micro kernels, were addressed, covering issues in IPv6 TSO handling, CPU cache initialization, AMD processor data leakage, and numerous subsystems such as coresight, schedulers, USB, SCSI, networking, and filesystems.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39770 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39770.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39770" }, { "cve": "CVE-2025-39772", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Multiple security vulnerabilities affecting Linux kernel subsystems, AMD processors, and virtualization components were addressed across various SUSE Linux Enterprise and Micro kernel versions, including fixes for NULL pointer dereferences, race conditions, and branch predictor isolation flaws.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39772 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39772.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39772" }, { "cve": "CVE-2025-39773", "cwe": { "id": "CWE-667", "name": "Improper Locking" }, "notes": [ { "category": "other", "text": "Improper Locking", "title": "CWE-667" }, { "category": "description", "text": "Multiple security vulnerabilities affecting the Linux kernel, including timer overflow, CPU cache initialization flaws, AMD processor data leakage, and the VMSCAPE branch predictor isolation flaw, were addressed across various SUSE Linux Enterprise and Micro kernel versions.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39773 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39773.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39773" }, { "cve": "CVE-2025-39776", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple Linux kernel vulnerabilities were fixed, including memory corruption in debug_vm_pgtable, CPU cache initialization flaws, AMD processor data leakage, AppArmor LSM issues, and the VMSCAPE branch predictor isolation flaw across various architectures and subsystems.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39776 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39776.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39776" }, { "cve": "CVE-2025-39782", "cwe": { "id": "CWE-667", "name": "Improper Locking" }, "notes": [ { "category": "other", "text": "Improper Locking", "title": "CWE-667" }, { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel components, including CPU architectures, drivers, filesystems, and subsystems such as jbd2_log_do_checkpoint and branch predictor isolation (VMSCAPE), were identified and addressed across SUSE Linux Enterprise and Micro kernels.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39782 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39782.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39782" }, { "cve": "CVE-2025-39783", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple security vulnerabilities affecting the Linux kernel and AMD processors, including use-after-free bugs, CPU data leakage, SEV-SNP memory integrity issues, and the VMSCAPE flaw in branch predictor isolation, were fixed across various subsystems and architectures.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39783 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39783.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39783" }, { "cve": "CVE-2025-39787", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel architectures, drivers, and subsystems—including MDT loader buffer validation, CPU cache initialization, AMD processor data leakage, and branch predictor isolation (VMSCAPE)—were identified and addressed in SUSE Linux Enterprise and Micro kernel updates.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39787 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39787.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39787" }, { "cve": "CVE-2025-39788", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple security vulnerabilities and bugs affecting various Linux kernel subsystems, including scsi: ufs: exynos driver, CPU cache initialization, AMD processor data leakage, and branch predictor isolation, were fixed across SUSE Linux Enterprise and other kernel versions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39788 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39788.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39788" }, { "cve": "CVE-2025-39790", "cwe": { "id": "CWE-415", "name": "Double Free" }, "notes": [ { "category": "other", "text": "Double Free", "title": "CWE-415" }, { "category": "description", "text": "Multiple security vulnerabilities affecting Linux kernel subsystems, including the MHI host driver, CPU cache initialization, AMD processors, and branch predictor isolation (VMSCAPE), were identified and patched across various SUSE Linux Enterprise and Micro kernel versions.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39790 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39790.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39790" }, { "cve": "CVE-2025-39794", "notes": [ { "category": "description", "text": "Multiple Linux kernel updates from SUSE and others fixed numerous security vulnerabilities including ARM Tegra I/O memcpy issues, CPU cache initialization flaws, AMD processor data leakage, and the VMSCAPE vulnerability across various architectures and subsystems.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39794 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39794.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39794" }, { "cve": "CVE-2025-39795", "cwe": { "id": "CWE-674", "name": "Uncontrolled Recursion" }, "notes": [ { "category": "other", "text": "Uncontrolled Recursion", "title": "CWE-674" }, { "category": "description", "text": "A comprehensive Linux kernel update addressed multiple critical security vulnerabilities, including CPU cache memory initialization flaws, AMD processor data leakage, the VMSCAPE vulnerability, and various issues across numerous subsystems and architectures.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39795 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39795.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39795" }, { "cve": "CVE-2025-39798", "cwe": { "id": "CWE-273", "name": "Improper Check for Dropped Privileges" }, "notes": [ { "category": "other", "text": "Improper Check for Dropped Privileges", "title": "CWE-273" }, { "category": "description", "text": "Multiple Linux kernel updates from SUSE address numerous critical security vulnerabilities including memory leaks, race conditions, use-after-free bugs, CPU cache and AMD processor flaws, and the VMSCAPE vulnerability affecting virtualization isolation.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39798 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39798.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39798" }, { "cve": "CVE-2025-39800", "notes": [ { "category": "description", "text": "Multiple security vulnerabilities affecting the Linux kernel, including btrfs metadata corruption, AMD processor flaws, and various subsystems such as memory management, networking, and drivers, were fixed across SUSE Linux Enterprise and Micro products.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39800 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39800.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39800" }, { "cve": "CVE-2025-39801", "cwe": { "id": "CWE-617", "name": "Reachable Assertion" }, "notes": [ { "category": "other", "text": "Reachable Assertion", "title": "CWE-617" }, { "category": "description", "text": "Multiple security vulnerabilities affecting AMD processors and various Linux kernel subsystems, including USB, networking, filesystems, and drivers, were identified and fixed across SUSE Linux Enterprise and Micro kernels, alongside a VMSCAPE flaw impacting branch predictor isolation.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39801 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39801.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U", "baseScore": 6.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39801" }, { "cve": "CVE-2025-39806", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel subsystems, including HID multitouch, AppArmor, coresight, sched, USB, SCSI, KVM, and AMD processors, were identified and addressed across SUSE Linux Enterprise and Micro kernel versions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39806 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39806.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39806" }, { "cve": "CVE-2025-39808", "notes": [ { "category": "description", "text": "Multiple security vulnerabilities affecting the Linux kernel, including a page fault in the hid-ntrig driver, flaws in AppArmor LSM, the VMSCAPE branch predictor isolation issue, and AMD Zen processor EntrySign flaw, were addressed across various SUSE Linux Enterprise and Micro kernel updates.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39808 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39808.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39808" }, { "cve": "CVE-2025-39812", "cwe": { "id": "CWE-908", "name": "Use of Uninitialized Resource" }, "notes": [ { "category": "other", "text": "Use of Uninitialized Resource", "title": "CWE-908" }, { "category": "description", "text": "Multiple Linux kernel updates from SUSE and others address numerous security vulnerabilities across networking, filesystems, drivers, and subsystems including critical AppArmor LSM flaws and a branch predictor isolation issue (VMSCAPE).", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39812 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39812.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39812" }, { "cve": "CVE-2025-39813", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" }, "notes": [ { "category": "other", "text": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "title": "CWE-362" }, { "category": "description", "text": "Multiple Linux kernel updates from SUSE address numerous security vulnerabilities including race conditions in ftrace, flaws in AppArmor LSM, AMD CPU microcode verification issues, and the VMSCAPE branch predictor isolation vulnerability across various subsystems and architectures.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39813 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39813.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39813" }, { "cve": "CVE-2025-39817", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "Multiple security vulnerabilities in the Linux kernel and AppArmor LSM affecting various subsystems such as efivarfs, crypto, bpf, cifs, and architectures were fixed, including slab-out-of-bounds, use-after-free, race conditions, and CPU microcode verification flaws.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39817 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39817.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39817" }, { "cve": "CVE-2025-39819", "notes": [ { "category": "description", "text": "Multiple updates to SUSE Linux Enterprise kernels address numerous security vulnerabilities including inconsistent reference count handling in SMB filesystem, AppArmor LSM privilege escalations, and AMD Zen CPU microcode verification flaws.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39819 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39819.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39819" }, { "cve": "CVE-2025-39823", "cwe": { "id": "CWE-129", "name": "Improper Validation of Array Index" }, "notes": [ { "category": "other", "text": "Improper Validation of Array Index", "title": "CWE-129" }, { "category": "description", "text": "Multiple Linux kernel updates across SUSE Linux Enterprise and Micro versions addressed numerous security vulnerabilities including speculative execution side-channel mitigations, AppArmor LSM flaws, AMD CPU microcode issues, and branch predictor isolation (VMSCAPE), affecting various subsystems and drivers.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39823 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39823.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39823" }, { "cve": "CVE-2025-39824", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple security vulnerabilities, including use-after-free in the ASUS HID driver, AppArmor LSM flaws, VMSCAPE branch predictor isolation, and CPU microcode signature issues in AMD Zen processors, affect various Linux kernel subsystems and architectures.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39824 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39824.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39824" }, { "cve": "CVE-2025-39825", "cwe": { "id": "CWE-366", "name": "Race Condition within a Thread" }, "notes": [ { "category": "other", "text": "Race Condition within a Thread", "title": "CWE-366" }, { "category": "other", "text": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "title": "CWE-362" }, { "category": "description", "text": "Multiple Linux kernel updates from SUSE address numerous security vulnerabilities including race conditions, use-after-free bugs, memory leaks, and critical flaws in the AppArmor LSM and AMD Zen CPU microcode verification across various architectures and subsystems.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39825 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39825.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39825" }, { "cve": "CVE-2025-39826", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple security vulnerabilities including race conditions, use-after-free bugs, privilege escalations, denial of service, and information leaks were fixed across various Linux kernel subsystems and the AppArmor LSM in SUSE Linux Enterprise and Micro kernels.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39826 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39826.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39826" }, { "cve": "CVE-2025-39827", "notes": [ { "category": "description", "text": "Multiple Linux kernel updates, including SUSE Enterprise and Micro versions, address numerous security vulnerabilities such as slab-use-after-free, privilege escalation, denial of service, and information leaks across various subsystems, drivers, and architectures, with notable fixes in AppArmor LSM and AMD Zen microcode verification.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39827 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39827.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39827" }, { "cve": "CVE-2025-39828", "notes": [ { "category": "description", "text": "Multiple critical security vulnerabilities, including flaws in the Linux kernel's ATM TCP driver, AppArmor LSM, and a branch predictor isolation issue (VMSCAPE), were fixed across various SUSE Linux Enterprise and Micro kernel versions affecting numerous architectures and subsystems.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39828 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39828.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39828" }, { "cve": "CVE-2025-39835", "notes": [ { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel subsystems, including XFS filesystem, AppArmor LSM, AMD processors, and branch predictor isolation (VMSCAPE), were fixed across SUSE Linux Enterprise and Micro kernels to prevent system crashes, privilege escalation, and data exposure.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39835 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39835.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39835" }, { "cve": "CVE-2025-39838", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Multiple security vulnerabilities including NULL pointer dereferences, memory leaks, race conditions, and privilege escalation flaws in the Linux kernel and AppArmor module were addressed through extensive updates across SUSE Linux Enterprise and Micro kernels, as well as AMD processor microcode.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39838 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39838.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39838" }, { "cve": "CVE-2025-39839", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel versions and subsystems, including batman-adv, AppArmor, and AMD processors, were identified and fixed, addressing issues such as out-of-bounds reads/writes, race conditions, use-after-free, and information exposure.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39839 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39839.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39839" }, { "cve": "CVE-2025-39841", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple critical security vulnerabilities affecting various Linux kernel subsystems, including SCSI drivers, AppArmor security module, memory management, and a branch predictor isolation flaw (VMSCAPE), were addressed in updates for SUSE Linux Enterprise and Linux kernel versions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39841 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39841.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39841" }, { "cve": "CVE-2025-39842", "notes": [ { "category": "description", "text": "Multiple security vulnerabilities including null pointer dereferences in ocfs2, AppArmor LSM privilege escalations, and AMD Zen microcode flaws were fixed across various SUSE Linux Enterprise and Micro kernel versions, addressing memory leaks, race conditions, and driver issues.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39842 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39842.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39842" }, { "cve": "CVE-2025-39843", "cwe": { "id": "CWE-833", "name": "Deadlock" }, "notes": [ { "category": "other", "text": "Deadlock", "title": "CWE-833" }, { "category": "other", "text": "Improper Locking", "title": "CWE-667" }, { "category": "description", "text": "Multiple security vulnerabilities in the Linux kernel and AppArmor LSM, including a deadlock in the SLUB allocator and AMD CPU microcode verification flaws, were fixed to prevent denial of service, privilege escalation, and information leaks across numerous architectures and subsystems.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39843 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39843.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39843" }, { "cve": "CVE-2025-39844", "notes": [ { "category": "description", "text": "Multiple security vulnerabilities affecting various Linux kernel subsystems, including AppArmor, memory management, drivers, and AMD processors, were discovered and addressed across SUSE Linux Enterprise and Micro kernels, involving privilege escalation, denial of service, and information exposure risks.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39844 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39844.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39844" }, { "cve": "CVE-2025-39845", "cwe": { "id": "CWE-401", "name": "Missing Release of Memory after Effective Lifetime" }, "notes": [ { "category": "other", "text": "Missing Release of Memory after Effective Lifetime", "title": "CWE-401" }, { "category": "description", "text": "Multiple security vulnerabilities and bugs affecting Linux kernel subsystems, including AppArmor LSM, x86/mm/64 paging, and AMD processors, were addressed in various SUSE Linux Enterprise and Micro kernel updates to fix privilege escalation, memory leaks, race conditions, and system crashes.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39845 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39845.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39845" }, { "cve": "CVE-2025-39846", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Multiple security vulnerabilities including NULL pointer dereferences, race conditions, use-after-free, memory leaks, and privilege escalation flaws were addressed across various Linux kernel subsystems and architectures, affecting SUSE Linux Enterprise and other distributions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39846 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39846.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39846" }, { "cve": "CVE-2025-39847", "cwe": { "id": "CWE-772", "name": "Missing Release of Resource after Effective Lifetime" }, "notes": [ { "category": "other", "text": "Missing Release of Resource after Effective Lifetime", "title": "CWE-772" }, { "category": "other", "text": "Missing Release of Memory after Effective Lifetime", "title": "CWE-401" }, { "category": "description", "text": "Multiple security vulnerabilities, including memory leaks, privilege escalation, denial of service, and information leaks, were identified and fixed across various Linux kernel subsystems, drivers, and architectures, notably affecting SUSE Linux Enterprise and AppArmor modules.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39847 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39847.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39847" }, { "cve": "CVE-2025-39848", "cwe": { "id": "CWE-401", "name": "Missing Release of Memory after Effective Lifetime" }, "notes": [ { "category": "other", "text": "Missing Release of Memory after Effective Lifetime", "title": "CWE-401" }, { "category": "description", "text": "Multiple security vulnerabilities and regressions affecting the Linux kernel, including the AppArmor security module, AMD CPU microcode verification, and subsystems like coresight, sched, usb, scsi, and netfilter, were fixed across various SUSE Linux Enterprise and Micro kernel versions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39848 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39848.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39848" }, { "cve": "CVE-2025-39849", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple security vulnerabilities affecting the Linux kernel, including a critical SSID length bounds check fix in cfg80211, numerous AppArmor LSM flaws, and a critical AMD Zen CPU microcode signature verification issue, were addressed across various SUSE Linux Enterprise and Micro kernel versions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39849 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39849.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39849" }, { "cve": "CVE-2025-39853", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "Multiple security vulnerabilities affecting the Linux kernel, including the i40e driver, AppArmor LSM, and AMD CPU microcode, were fixed across various SUSE Linux Enterprise and Micro kernel versions to address privilege escalation, denial of service, and information leaks.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39853 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39853.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39853" }, { "cve": "CVE-2025-39857", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Multiple security vulnerabilities including NULL pointer dereferences, race conditions, memory leaks, use-after-free bugs, and flaws in the AppArmor Linux kernel Security Module and AMD Zen microcode verification were addressed across various SUSE Linux Enterprise and Micro kernel versions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39857 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39857.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39857" }, { "cve": "CVE-2025-39860", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple security vulnerabilities including use-after-free in Bluetooth, flaws in AppArmor LSM, branch predictor isolation (VMSCAPE), and AMD Zen CPU microcode loading were fixed across various Linux kernel versions and SUSE Enterprise products to address privilege escalation, denial of service, and information leaks.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39860 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39860.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39860" }, { "cve": "CVE-2025-39864", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple security vulnerabilities, including use-after-free bugs, branch predictor isolation flaws (VMSCAPE), and issues in AppArmor LSM and AMD CPU microcode verification, were identified and fixed across various Linux kernel subsystems and architectures.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39864 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39864.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39864" }, { "cve": "CVE-2025-39865", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Multiple Linux kernel updates from SUSE and others address critical security vulnerabilities including NULL pointer dereferences, memory leaks, race conditions, branch predictor isolation flaws (VMSCAPE), and AMD CPU microcode signature verification issues across various subsystems and architectures.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39865 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39865.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39865" }, { "cve": "CVE-2025-39866", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple Linux kernel updates from SUSE address critical security vulnerabilities including use-after-free, race conditions, privilege escalation, denial of service, information leaks, and the VMSCAPE branch predictor isolation flaw across various architectures and subsystems.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-39866 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-39866.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-39866" }, { "cve": "CVE-2025-40300", "cwe": { "id": "CWE-402", "name": "Transmission of Private Resources into a New Sphere ('Resource Leak')" }, "notes": [ { "category": "other", "text": "Transmission of Private Resources into a New Sphere ('Resource Leak')", "title": "CWE-402" }, { "category": "description", "text": "Multiple Linux kernel updates address the VMSCAPE vulnerability and numerous other security issues including memory leaks, use-after-free, race conditions, and hardware-specific bugs across various subsystems and SUSE Linux Enterprise product lines.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-40300 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40300.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-40300" }, { "cve": "CVE-2025-40833", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Certain devices exhibit a null pointer dereference vulnerability in processing specific IPv4 requests, which can lead to a denial of service condition requiring manual system restart.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-40833 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40833.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-40833" }, { "cve": "CVE-2025-40946", "cwe": { "id": "CWE-321", "name": "Use of Hard-coded Cryptographic Key" }, "notes": [ { "category": "other", "text": "Use of Hard-coded Cryptographic Key", "title": "CWE-321" }, { "category": "description", "text": "A vulnerability in multiple BluePlanet device models allows attackers to derive Technical Service credentials from device serial numbers using a CRC16-based algorithm, enabling unauthorized access.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-40946 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40946.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "baseScore": 8.3, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-40946" }, { "cve": "CVE-2025-40947", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "title": "CWE-78" }, { "category": "description", "text": "A vulnerability in multiple RUGGEDCOM ROX device models below version V2.17.1 allows authenticated remote attackers to execute arbitrary commands with root privileges due to improper sanitization of user input during feature key installation.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-40947 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40947.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-40947" }, { "cve": "CVE-2025-40948", "cwe": { "id": "CWE-88", "name": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')", "title": "CWE-88" }, { "category": "description", "text": "A vulnerability in RUGGEDCOM ROX devices below version 2.17.1 allows authenticated remote attackers to read arbitrary files with root privileges via improper input validation in the web server's JSON-RPC interface.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-40948 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40948.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "baseScore": 6.8, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-40948" }, { "cve": "CVE-2025-40949", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "title": "CWE-78" }, { "category": "description", "text": "A command injection vulnerability in RUGGEDCOM ROX devices below version 2.17.1 allows authenticated remote attackers to execute arbitrary commands with root privileges via the Scheduler functionality in the Web UI.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-40949 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40949.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-40949" }, { "cve": "CVE-2025-43368", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple use-after-free vulnerabilities and memory management issues in WebKitGTK, Safari, iOS, iPadOS, macOS, and Oracle Java SE 8u471-b50 were fixed to prevent crashes, memory corruption, and potential system compromise from malicious web content.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-43368 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43368.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-43368" }, { "cve": "CVE-2025-46836", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "description", "text": "Net-tools versions up to 2.10 contain multiple stack-based buffer overflow vulnerabilities, including CVE-2025-46836, due to missing bounds checks in interface label handling and unsafe memory operations, potentially allowing arbitrary code execution or crashes.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-46836 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-46836.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H", "baseScore": 6.6, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-46836" }, { "cve": "CVE-2025-47219", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "Multiple security vulnerabilities affect GStreamer plugins, Oracle Java SE 8u471-b50's JavaFX gstreamer component, and Oracle Database Server's GraalVM engine, including heap buffer over-reads and unauthorized data access risks.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-47219 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-47219.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-47219" }, { "cve": "CVE-2025-48989", "cwe": { "id": "CWE-404", "name": "Improper Resource Shutdown or Release" }, "notes": [ { "category": "other", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "description", "text": "Apache Tomcat versions 9.0.0.M1 to 11.0.9 are vulnerable to the MadeYouReset denial of service attack exploiting improper HTTP/2 stream resets, with multiple updates released to address this and other related security and stability issues.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-48989 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48989.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-48989" }, { "cve": "CVE-2025-49794", "cwe": { "id": "CWE-825", "name": "Expired Pointer Dereference" }, "notes": [ { "category": "other", "text": "Expired Pointer Dereference", "title": "CWE-825" }, { "category": "description", "text": "Multiple vulnerabilities in libxml2, including heap use after free, type confusion, stack buffer overflow, and integer overflow, can lead to denial of service, crashes, or data manipulation in affected Oracle products and other environments.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-49794 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-49794.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-49794" }, { "cve": "CVE-2025-49796", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "Multiple vulnerabilities in libxml2, including heap use-after-free, type confusion, stack buffer overflow, integer overflow, and null pointer dereference, can lead to denial of service, crashes, or unauthorized data modification.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-49796 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-49796.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-49796" }, { "cve": "CVE-2025-53057", "cwe": { "id": "CWE-838", "name": "Inappropriate Encoding for Output Context" }, "notes": [ { "category": "other", "text": "Inappropriate Encoding for Output Context", "title": "CWE-838" }, { "category": "description", "text": "Multiple vulnerabilities including CVE-2025-53057, CVE-2025-53066, and CVE-2025-61748 affect Oracle Java SE and OpenJDK versions 8u461 through 25, allowing unauthenticated network attackers to access and modify critical data via APIs with a CVSS score of 5.9.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-53057 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-53057.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 5.9, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-53057" }, { "cve": "CVE-2025-53066", "notes": [ { "category": "description", "text": "Multiple critical vulnerabilities (CVE-2025-53057, CVE-2025-53066, CVE-2025-61748) in Oracle Java SE and GraalVM across versions 8u461, 11.0.28, 17.0.16, 21.0.8, and 25 allow unauthenticated attackers to gain unauthorized access and modify sensitive data via APIs and XML External Entity attacks.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-53066 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-53066.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-53066" }, { "cve": "CVE-2025-55752", "cwe": { "id": "CWE-23", "name": "Relative Path Traversal" }, "notes": [ { "category": "other", "text": "Relative Path Traversal", "title": "CWE-23" }, { "category": "description", "text": "Multiple Apache Tomcat versions up to 11.0.13 suffer from directory traversal and URL normalization vulnerabilities that allow bypassing security constraints and potential remote code execution via PUT requests, alongside other issues like denial of service and improper input handling.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-55752 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-55752.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-55752" }, { "cve": "CVE-2025-55754", "cwe": { "id": "CWE-150", "name": "Improper Neutralization of Escape, Meta, or Control Sequences" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Escape, Meta, or Control Sequences", "title": "CWE-150" }, { "category": "description", "text": "Multiple vulnerabilities in Apache Tomcat versions up to 11.0.10, 10.1.44, and 9.0.108 include improper neutralization of ANSI escape sequences in log messages, directory traversal with possible remote code execution, denial of service, and other security issues, with fixes in later versions.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-55754 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-55754.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "baseScore": 9.6, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-55754" }, { "cve": "CVE-2025-61748", "cwe": { "id": "CWE-581", "name": "Object Model Violation: Just One of Equals and Hashcode Defined" }, "notes": [ { "category": "other", "text": "Object Model Violation: Just One of Equals and Hashcode Defined", "title": "CWE-581" }, { "category": "description", "text": "Multiple security vulnerabilities affecting Oracle Java SE, Oracle GraalVM, NetApp products, IBM Java, and OpenJDK versions 21 and 25 involve unauthorized data modification, encoded string handling, XML External Entity attacks, and certificate handling with CVSS scores up to 3.7.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-61748 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-61748.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 3.7, "baseSeverity": "LOW" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-61748" }, { "cve": "CVE-2025-61795", "cwe": { "id": "CWE-404", "name": "Improper Resource Shutdown or Release" }, "notes": [ { "category": "other", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "description", "text": "Multiple Apache Tomcat versions up to 11.0.13, 10.1.48, and 9.0.115 contain vulnerabilities including denial of service from delayed cleanup of multipart upload files, directory traversal with possible remote code execution, and improper input neutralization.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2025-61795 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-61795.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2025-61795" }, { "cve": "CVE-2026-2673", "cwe": { "id": "CWE-757", "name": "Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')" }, "notes": [ { "category": "other", "text": "Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')", "title": "CWE-757" }, { "category": "other", "text": "Missing Cryptographic Step", "title": "CWE-325" }, { "category": "description", "text": "OpenSSL versions 3.5.x and 3.6.x contain a TLS 1.3 key exchange group selection flaw involving the 'DEFAULT' keyword that affects post-quantum group negotiation, alongside multiple other security vulnerabilities including memory handling and RSA KEM issues.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-2673 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-2673.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-2673" }, { "cve": "CVE-2026-21925", "cwe": { "id": "CWE-322", "name": "Key Exchange without Entity Authentication" }, "notes": [ { "category": "other", "text": "Key Exchange without Entity Authentication", "title": "CWE-322" }, { "category": "description", "text": "Multiple vulnerabilities in Oracle Java SE and GraalVM RMI components across various versions allow unauthenticated network attackers to gain unauthorized access, with updates addressing security flaws in RMI, AWT/JavaFX, Networking, and Security components.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-21925 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21925.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 4.8, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-21925" }, { "cve": "CVE-2026-21932", "cwe": { "id": "CWE-1287", "name": "Improper Validation of Specified Type of Input" }, "notes": [ { "category": "other", "text": "Improper Validation of Specified Type of Input", "title": "CWE-1287" }, { "category": "description", "text": "Multiple vulnerabilities in Oracle Java SE and GraalVM components including RMI, AWT, JavaFX, Networking, and Security allow unauthenticated remote attackers to compromise data integrity and execute attacks across various supported Java versions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-21932 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21932.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "baseScore": 7.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-21932" }, { "cve": "CVE-2026-21933", "cwe": { "id": "CWE-93", "name": "Improper Neutralization of CRLF Sequences ('CRLF Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of CRLF Sequences ('CRLF Injection')", "title": "CWE-93" }, { "category": "description", "text": "Multiple vulnerabilities in Oracle Java SE and GraalVM components across various versions allow unauthenticated remote attackers to access, modify data, execute code, or redirect users, with updates addressing issues in RMI, AWT/JavaFX, Networking, and Security components.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-21933 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21933.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-21933" }, { "cve": "CVE-2026-21945", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "other", "text": "Improper Certificate Validation", "title": "CWE-295" }, { "category": "description", "text": "Multiple critical vulnerabilities in Oracle Java SE and GraalVM affect components such as RMI, AWT/JavaFX, Networking, and Security, allowing unauthenticated remote attackers to cause denial of service, execute code, steal information, or modify files across various Java versions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-21945 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21945.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-21945" }, { "cve": "CVE-2026-21947", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "title": "CWE-79" }, { "category": "description", "text": "Oracle Java SE JavaFX 8u471-b50 contains a difficult-to-exploit vulnerability allowing unauthenticated network attackers with user interaction to modify data in sandboxed applications, while GraalVM Multilingual Engine has a non-exploitable security-in-depth issue in Oracle Database Server.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-21947 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21947.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 3.1, "baseSeverity": "LOW" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-21947" }, { "cve": "CVE-2026-22924", "cwe": { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, "notes": [ { "category": "other", "text": "Missing Authentication for Critical Function", "title": "CWE-306" }, { "category": "description", "text": "A vulnerability in SIMATIC CN 4100 versions below V5.0 allows unauthenticated connections and resource exhaustion, potentially disrupting operations and compromising system availability and integrity.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-22924 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-22924.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-22924" }, { "cve": "CVE-2026-22925", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "other", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "description", "text": "A vulnerability in SIMATIC CN 4100 versions below V5.0 allows denial-of-service by exhausting system resources through a high volume of TCP SYN packets.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-22925 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-22925.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-22925" }, { "cve": "CVE-2026-25786", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "title": "CWE-79" }, { "category": "description", "text": "Certain devices fail to properly validate and sanitize PLC/station names on the web interface's communication parameters page, enabling authenticated users with project download rights to inject malicious scripts executed upon page access by legitimate users.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-25786 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-25786.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-25786" }, { "cve": "CVE-2026-25787", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "title": "CWE-79" }, { "category": "description", "text": "A vulnerability in the 'Motion Control Diagnostics' web page allows authenticated users with project download rights to inject malicious scripts via improper validation of Technology Object names, enabling script execution in other users' sessions.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-25787 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-25787.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-25787" }, { "cve": "CVE-2026-25789", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "title": "CWE-79" }, { "category": "description", "text": "Certain devices fail to properly validate filenames on their Firmware Update page, allowing remote attackers to execute malicious JavaScript through social engineering, potentially leading to session hijacking or credential theft.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-25789 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-25789.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-25789" }, { "cve": "CVE-2026-27446", "cwe": { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, "notes": [ { "category": "other", "text": "Missing Authentication for Critical Function", "title": "CWE-306" }, { "category": "description", "text": "A missing authentication vulnerability in Apache Artemis and ActiveMQ Artemis Core protocol allows unauthenticated remote attackers to inject or exfiltrate messages by forcing brokers to connect to rogue brokers in affected versions.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-27446 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27446.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-27446" }, { "cve": "CVE-2026-27662", "cwe": { "id": "CWE-1188", "name": "Initialization of a Resource with an Insecure Default" }, "notes": [ { "category": "other", "text": "Initialization of a Resource with an Insecure Default", "title": "CWE-1188" }, { "category": "description", "text": "Affected devices inadequately restrict web browser access via the Control Panel, enabling unauthenticated attackers to gain unauthorized access and potentially exploit system vulnerabilities.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-27662 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27662.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "baseScore": 7.7, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-27662" }, { "cve": "CVE-2026-28387", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "description", "text": "Multiple OpenSSL versions contain critical vulnerabilities including use-after-free in DANE client code, NULL pointer dereferences, heap buffer overflows, and RSA KEM failure handling issues, affecting TLS and cryptographic operations.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-28387 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28387.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-28387" }, { "cve": "CVE-2026-28388", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "A NULL pointer dereference vulnerability in OpenSSL's delta CRL processing can cause application crashes and Denial of Service, with exploitation requiring specific conditions and assessed as low severity.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-28388 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28388.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-28388" }, { "cve": "CVE-2026-28389", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "Multiple OpenSSL vulnerabilities including NULL pointer dereferences in CMS KeyAgreeRecipientInfo processing, use-after-free, heap buffer overflow, and TLS 1.3 key agreement issues can cause application crashes and Denial of Service, affecting various OpenSSL versions and some NetApp products.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-28389 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28389.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-28389" }, { "cve": "CVE-2026-28390", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "A NULL pointer dereference vulnerability (CVE-2026-28390) in OpenSSL occurs during processing of crafted CMS EnvelopedData messages with KeyTransportRecipientInfo using RSA-OAEP, potentially causing application crashes and Denial of Service.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-28390 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28390.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-28390" }, { "cve": "CVE-2026-31789", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple OpenSSL vulnerabilities including a heap buffer overflow in hexadecimal conversion on 32-bit platforms, use-after-free, NULL pointer dereferences, TLS 1.3 key agreement issues, and RSA KEM failure handling have been identified, affecting various versions and products.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-31789 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-31789.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-31789" }, { "cve": "CVE-2026-31790", "cwe": { "id": "CWE-754", "name": "Improper Check for Unusual or Exceptional Conditions" }, "notes": [ { "category": "other", "text": "Improper Check for Unusual or Exceptional Conditions", "title": "CWE-754" }, { "category": "other", "text": "Access of Uninitialized Pointer", "title": "CWE-824" }, { "category": "description", "text": "OpenSSL's RSASVE key encapsulation vulnerability (CVE-2026-31790) allows sensitive data leakage from uninitialized memory due to improper handling of RSA_public_encrypt() failures and invalid RSA public key validation, affecting multiple products including Oracle Database Server and NetApp devices.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-31790 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-31790.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-31790" }, { "cve": "CVE-2026-33862", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "title": "CWE-79" }, { "category": "description", "text": "Multiple versions of Teamcenter contain a vulnerability where improper encoding or filtering of user-supplied data allows attackers to inject malicious code that executes when other users access the affected content.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-33862 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-33862.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "baseScore": 7.3, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-33862" }, { "cve": "CVE-2026-33893", "cwe": { "id": "CWE-798", "name": "Use of Hard-coded Credentials" }, "notes": [ { "category": "other", "text": "Use of Hard-coded Credentials", "title": "CWE-798" }, { "category": "description", "text": "Multiple versions of Teamcenter contain hardcoded obfuscation keys embedded in the application, which attackers can extract to gain unauthorized access.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-33893 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-33893.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-33893" }, { "cve": "CVE-2026-40175", "cwe": { "id": "CWE-113", "name": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')", "title": "CWE-113" }, { "category": "other", "text": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "title": "CWE-444" }, { "category": "other", "text": "Server-Side Request Forgery (SSRF)", "title": "CWE-918" }, { "category": "other", "text": "Improperly Controlled Modification of Dynamically-Determined Object Attributes", "title": "CWE-915" }, { "category": "description", "text": "Axios versions prior to 1.15.0 and 0.3.1 contain a prototype pollution vulnerability exploitable via a header injection gadget chain, enabling escalation to remote code execution or full cloud compromise including AWS IMDSv2 bypass.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-40175 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-40175.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10.0, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-40175" }, { "cve": "CVE-2026-41125", "cwe": { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "title": "CWE-89" }, { "category": "description", "text": "An SQL injection vulnerability in the KACO Meteor server of blueplanet devices allows an authorized local network attacker to escalate privileges.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-41125 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41125.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H", "baseScore": 6.0, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-41125" }, { "cve": "CVE-2026-41551", "cwe": { "id": "CWE-23", "name": "Relative Path Traversal" }, "notes": [ { "category": "other", "text": "Relative Path Traversal", "title": "CWE-23" }, { "category": "description", "text": "A path traversal vulnerability in ROS# versions prior to V2.2.2 allows remote attackers to access arbitrary files due to improper sanitization of user input.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-41551 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41551.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-41551" }, { "cve": "CVE-2026-44411", "cwe": { "id": "CWE-824", "name": "Access of Uninitialized Pointer" }, "notes": [ { "category": "other", "text": "Access of Uninitialized Pointer", "title": "CWE-824" }, { "category": "description", "text": "A vulnerability in Solid Edge SE2026 versions before V226.0 Update 5 allows remote code execution via uninitialized pointer access during parsing of specially crafted PAR files.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-44411 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-44411.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-44411" }, { "cve": "CVE-2026-44412", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "description", "text": "A stack-based buffer overflow vulnerability in Solid Edge SE2026 (all versions before V226.0 Update 5) when parsing specially crafted PAR files could enable code execution within the current process context.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] }, "references": [ { "category": "self", "summary": "CVE-2026-44412 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-44412.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9", "CSAFPID-10", "CSAFPID-11", "CSAFPID-12", "CSAFPID-13", "CSAFPID-14", "CSAFPID-15", "CSAFPID-16", "CSAFPID-17", "CSAFPID-18", "CSAFPID-19", "CSAFPID-20", "CSAFPID-21", "CSAFPID-22", "CSAFPID-23", "CSAFPID-24", "CSAFPID-25", "CSAFPID-26", "CSAFPID-27", "CSAFPID-28", "CSAFPID-29", "CSAFPID-30", "CSAFPID-31", "CSAFPID-32", "CSAFPID-33", "CSAFPID-34", "CSAFPID-35", "CSAFPID-36", "CSAFPID-37", "CSAFPID-38", "CSAFPID-39", "CSAFPID-40", "CSAFPID-41", "CSAFPID-42", "CSAFPID-43", "CSAFPID-44", "CSAFPID-45", "CSAFPID-46" ] } ], "title": "CVE-2026-44412" } ] }