Filtered by vendor Linuxfoundation Subscriptions
Total 366 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-53009 1 Linuxfoundation 1 Materialx 2025-08-21 7.5 High
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In versions 1.39.2 and below, when parsing an MTLX file with multiple nested nodegraph implementations, the MaterialX XML parsing logic can potentially crash due to stack exhaustion. An attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file. This is fixed in version 1.39.3.
CVE-2025-53010 1 Linuxfoundation 1 Materialx 2025-08-21 7.5 High
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, when parsing shader nodes in a MTLX file, the MaterialXCore code accesses a potentially null pointer, which can lead to crashes with maliciously crafted files. An attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file. This is fixed in version 1.39.3.
CVE-2025-53011 1 Linuxfoundation 1 Materialx 2025-08-21 7.5 High
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, when parsing shader nodes in a MTLX file, the MaterialXCore code accesses a potentially null pointer, which can lead to crashes with maliciously crafted files. An attacker could intentionally crash a target program that uses MaterialX by sending a malicious MTLX file. This is fixed in version 1.39.3.
CVE-2025-53012 1 Linuxfoundation 1 Materialx 2025-08-21 7.5 High
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, nested imports of MaterialX files can lead to a crash via stack memory exhaustion, due to the lack of a limit on the "import chain" depth. When parsing file imports, recursion is used to process nested files; however, there is no limit imposed to the depth of files that can be parsed by the library. By building a sufficiently deep chain of MaterialX files one referencing the next, it is possible to crash the process using the MaterialX library via stack exhaustion. This is fixed in version 1.39.3.
CVE-2025-20696 6 Google, Linuxfoundation, Mediatek and 3 more 37 Android, Yocto, Mt6739 and 34 more 2025-08-18 6.8 Medium
In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09915215; Issue ID: MSV-3801.
CVE-2024-48063 2 Linuxfoundation, Pytorch 2 Pytorch, Pytorch 2025-07-16 9.8 Critical
In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed computing.
CVE-2024-34043 2 O-ran, Linuxfoundation 2 Ricapp Kpimon Go, Ric-app-kpimon-go 2025-07-14 5.3 Medium
O-RAN RICAPP kpimon-go I-Release has a segmentation violation via a certain E2AP-PDU message.
CVE-2023-52725 2 Linuxfoundation, Open Networking Foundation 2 Onos-kpimon, Sd-ran Onos 2025-07-14 6.5 Medium
Open Networking Foundation SD-RAN ONOS onos-kpimon 0.4.7 allows blocking of the errCh channel within the Start function of the monitoring package.
CVE-2023-52726 2 Linuxfoundation, Onosproject 2 Onos-ric-sdk-go, Onos 2025-07-14 6.5 Medium
Open Networking Foundation SD-RAN ONOS onos-ric-sdk-go 0.8.12 allows infinite repetition of the processing of an error (in the Subscribe function implementation for the subscribed indication stream).
CVE-2023-52728 1 Linuxfoundation 1 Onos-lib-go 2025-07-14 5.5 Medium
Open Networking Foundation SD-RAN ONOS onos-lib-go 0.10.25 allows an index out-of-range condition in putBitString.
CVE-2023-52727 1 Linuxfoundation 1 Onos-lib-go 2025-07-14 8.1 High
Open Networking Foundation SD-RAN ONOS onos-lib-go 0.10.25 allows an index out-of-range condition in parseAlignBits.
CVE-2023-52724 1 Linuxfoundation 1 Onos-kpimon 2025-07-14 8.1 High
Open Networking Foundation SD-RAN onos-kpimon 0.4.7 allows out-of-bounds array access in the processIndicationFormat1 function.
CVE-2025-20693 4 Google, Linuxfoundation, Mediatek and 1 more 26 Android, Yocto, Mt2737 and 23 more 2025-07-09 6.5 Medium
In wlan STA driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09812521; Issue ID: MSV-3421.
CVE-2024-24420 1 Linuxfoundation 1 Magma 2025-07-03 7.5 High
A reachable assertion in the decode_linked_ti_ie function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.
CVE-2024-24421 1 Linuxfoundation 1 Magma 2025-07-03 9.8 Critical
A type confusion in the nas_message_decode function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via a crafted NAS packet.
CVE-2023-6944 2 Linuxfoundation, Redhat 3 Backstage, Red Hat Developer Hub, Rhdh 2025-06-17 5.7 Medium
A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab token includes a newline at the end of the string. The sanitized error can display on the frontend, including the raw access token. Upon gaining access to this token and depending on permissions, an attacker could push malicious code to repositories, delete resources in Git, revoke or generate new keys, and sign code illegitimately.
CVE-2023-46740 1 Linuxfoundation 1 Cubefs 2025-06-17 6.5 Medium
CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string and impersonate a user thereby obtaining higher privileges. When CubeFS creates new users, it creates a piece of sensitive information for the user called the “accessKey”. To create the "accesKey", CubeFS uses an insecure string generator which makes it easy to guess and thereby impersonate the created user. An attacker could leverage the predictable random string generator and guess a users access key and impersonate the user to obtain higher privileges. The issue has been fixed in v3.3.1. There is no other mitigation than to upgrade.
CVE-2023-46739 1 Linuxfoundation 1 Cubefs 2025-06-17 6.5 Medium
CubeFS is an open-source cloud-native file storage system. A vulnerability was found during in the CubeFS master component in versions prior to 3.3.1 that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root case of the vulnerability was that CubeFS used raw string comparison of passwords. The vulnerable part of CubeFS was the UserService of the master component. The UserService gets instantiated when starting the server of the master component. The issue has been patched in v3.3.1. For impacted users, there is no other way to mitigate the issue besides upgrading.
CVE-2024-31580 2 Linuxfoundation, Pytorch 2 Pytorch, Pytorch 2025-06-10 4 Medium
PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2024-31583 2 Linuxfoundation, Pytorchlightning 2 Pytorch, Pytorch Lightning 2025-06-10 7.8 High
Pytorch before version v2.2.0 was discovered to contain a use-after-free vulnerability in torch/csrc/jit/mobile/interpreter.cpp.