VulniPulse uses Google Ads measurement to understand visits from advertisements and campaign performance. It runs cookie-free until you choose — accepting enables cookies for more accurate attribution. Rejecting keeps it cookie-free and never limits the site.
See exactly what is measuredComplete feed
1712 advisories across 32 monitored vendors.
concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::AtomicReference#update can enter a permanent busy retry loop when the current value is Float::NAN. The issue is caused by the interaction between AtomicReference#update, which retries until compare_and_set(old_value, new_value) succeeds; Numeric compare_and_set, which checks old == old_value before attempting the underlying atomic swap.; and Ruby NaN semantics, where Float::NAN == Float::NAN is always false. As a result, once an AtomicReference contains Float::NAN, calling #update repeatedly evaluates the caller's block and never returns. In services that store externally derived numeric values in an AtomicReference, this can cause CPU exhaustion or permanent request/job hangs. This vulnerability is fixed in 1.3.7. This occurs when the current value is a special 'Not a Number' (Float::NAN) floating-point value, causing the method to repeatedly attempt an operation without success. This can lead to a Denial of Service (DoS), where the affected application experiences CPU exhaustion or becomes unresponsive. The issue arises when the `AtomicReference#update` method encounters a `Float::NAN` value, leading to an infinite retry loop and potential CPU exhaustion.
concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReentrantReadWriteLock can incorrectly grant a write lock after one thread acquires the read lock 32,768 times. The lock stores a thread's local read and write hold counts in one integer. The low 15 bits are used for the read hold count, and bit 15 is used as WRITE_LOCK_HELD. This breaks the core mutual-exclusion guarantee: the caller is told it has a write lock, but other threads can still hold or acquire read locks at the same time. This vulnerability is fixed in 1.3.7. This occurs when a thread acquires a read lock 32,768 times, causing an internal counter to incorrectly indicate a write lock is held. This breaks the fundamental mutual-exclusion guarantee of the lock, potentially leading to unexpected behavior or data corruption due to concurrent access. Red Hat rates this flaw as Low impact, consistent with the upstream CVEORG assessment (2.0). The vulnerability requires a single thread to acquire the same ReentrantReadWriteLock read lock 32,768 times reentrantly before the internal counter overflows into the write-lock bit. This precondition does not arise in normal application usage. While concurrent-ruby ships the vulnerable lock class in Red Hat products, no transitive dependency was confirmed to instantiate ReentrantReadWriteLock.
Jenkins GitHub Branch Source Plugin: Jenkins GitHub Branch Source Plugin: Information disclosure via missing permission check. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-425.
Cross-site request forgery allows unauthorized configuration changes. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-940.
Argument Injection in TortoiseGitBlame via Malicious Git History Filenames Leads to Arbitrary File Write in TortoiseGit Affected product named by the advisory: GitLab.
Arbitrary Code Execution via Malicious Configuration or Environment Variable. Red Hat rates this moderate (CVSS 6). Weakness: CWE-94.
limit next_id allocation to the valid ID range. Red Hat rates this moderate (CVSS 5.8). Weakness: CWE-825.
Fix a potential NPD when removing a port from a VRF. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-820.
Reject SIOCATMARK on non-stream sockets. Red Hat rates this low (CVSS 5.5). Weakness: CWE-1287.
avoid NULL deref of conn->lnk in smc_msg_event tracepoint. Red Hat rates this low (CVSS 5.5). Weakness: CWE-476.
fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-476.
fix stack info leak in tap_ioctl() SIOCGIFHWADDR. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-909.
fully roll back denied add-stream state. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-825.
stop hash:* range iteration at end. Red Hat rates this low (CVSS 5.5). Weakness: CWE-193.
serialize orphan cleanup with shm_nattch updates. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-367.
jitterentropy - replace long-held spinlock with mutex. Red Hat rates this low (CVSS 5.5). Weakness: CWE-821.
reject oversized option lists. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-787.
fix OOB read in compat_mtw_from_user. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-1284.
virt-handler notify server trusts VMI identity from unauthenticated gRPC request body. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-287.
fix array_state=clear sysfs deadlock. Red Hat rates this low (CVSS 5.5).