2025

In the Linux kernel, the following vulnerability has been resolved: fuse: fix livelock in synchronous file put from fus

In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Fix race between SR-IOV enable/disable and

In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr: do not repeat pte_offset_map_lock()

In the Linux kernel, the following vulnerability has been resolved: pidfs: validate extensible ioctls Validate extensi

In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: don't rely on user vaddr alignment

A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings,

A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages.

A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files.

A vulnerability in FileStation file cgi allows remote authenticated users to read file metadata and path information.

A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files.

A flaw has been found in dayrui XunRuiCMS up to 4.7.1. This vulnerability affects unknown code of the file admin79f2ec22

A vulnerability was detected in dayrui XunRuiCMS up to 4.7.1. This affects an unknown part of the file /admin79f2ec220c7

A security vulnerability has been detected in dayrui XunRuiCMS up to 4.7.1. Affected by this issue is some unknown funct

Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager

Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2

Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-6

A weakness has been identified in dayrui XunRuiCMS up to 4.7.1. Affected by this vulnerability is an unknown functionali

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.1. Affected is an unknown function of the file /admind

In the Linux kernel, the following vulnerability has been resolved: xfrm: delete x->tunnel as we delete x The ipcomp f

In the Linux kernel, the following vulnerability has been resolved: af_unix: Initialise scc_index in unix_add_edge().

Central Dogma versions before 0.78.0 contain an Open Redirect vulnerability that allows attackers to redirect users to u

A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attac

A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attac

A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sen

The Custom Post Type UI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including,

The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions u

The Clik stats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` param

The Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration – Powered by Codisto plugin for WordPress is

The WebP Express plugin for WordPress is vulnerable to information exposure via config files in all versions up to, and

## Summary Authenticated SQL Injection Vulnerability in Endpoint Module Rest API

MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. Prior to 2.9.8, there is

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

XML external entity (XXE) injection in eyoucms v1.7.1 allows remote attackers to cause a denial of service via crafted b

An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to access admi

Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker

Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, w

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28

Step CA is an online certificate authority for secure, automated certificate management for DevOps. Prior to 0.29.0, the

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality all

RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive inte

RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive inte

RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive inte

An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certifi

Buffer Overflow was found in SmallBASIC community SmallBASIC with SDL Before v12_28, and commit sha:298a1d495355959db364

Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability i

DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS ce

Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing

Claude Code is an agentic coding tool. Prior to 1.0.93, Due to errors in parsing shell commands related to $IFS and shor