2025

In the Linux kernel, the following vulnerability has been resolved: crypto: aspeed - fix double free caused by devm Th

In the Linux kernel, the following vulnerability has been resolved: netpoll: Fix deadlock in memory allocation under sp

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix field-spanning memcpy warning in AH

In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: Do not dereference NULL pointer in plane

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix KASAN global-out-of-bounds warn

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix general protection fault in __smc_diag

In the Linux kernel, the following vulnerability has been resolved: sysfs: check visibility before changing group attri

In the Linux kernel, the following vulnerability has been resolved: arm64: mte: Do not warn if the page is already tagg

In the Linux kernel, the following vulnerability has been resolved: platform/mellanox: mlxbf-pmc: add sysfs_attr_init()

In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix KMSAN uninit-value issue in hfsplus_de

In the Linux kernel, the following vulnerability has been resolved: slab: Avoid race on slab->obj_exts in alloc_slab_ob

In the Linux kernel, the following vulnerability has been resolved: arch_topology: Fix incorrect error check in topolog

JLex GuestBook 1.6.4 contains a reflected cross-site scripting vulnerability in the 'q' URL parameter that allows attack

Lucee 5.4.2.17 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject mal

Member Login Script 3.3 contains a client-side desynchronization vulnerability that allows attackers to manipulate HTTP

SyncBreeze 15.2.24 contains a denial of service vulnerability in the login authentication mechanism that allows attacker

Wp2Fac 1.0 contains an OS command injection vulnerability in the send.php endpoint that allows remote attackers to execu

Jorani 1.0.3 contains a reflected cross-site scripting vulnerability in the language parameter that allows attackers to

WEBIGniter 28.7.23 contains a file upload vulnerability that allows authenticated attackers to upload and execute danger

A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard f

A security issue was found in the IPv6 stack in the Micro850 and Micro870 controllers when the controllers received mult

NetSupport Manager < 14.12.0001 contains an arbitrary file write vulnerability in its Connectivity Server/Gateway PUTFIL

NetSupport Manager < 14.12.0001 relies on a shared Gateway Key for authentication between Manager/Control, Client, and

NetSupport Manager < 14.12.0001 contains an unauthenticated SQL injection vulnerability in its Connectivity Server/Gatew

The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication check

Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X. This allows an attacker wi

PCSX2 is a free and open-source PlayStation 2 (PS2) emulator. In versions 2.5.377 and below, an unchecked offset and siz

In the Linux kernel, the following vulnerability has been resolved: usb: storage: sddr55: Reject out-of-bound new_pba

The CleverDisplay BlueOne hardware player is designed with its USB interfaces physically enclosed and inaccessible under

AnyDesk 7.0.15 and 9.0.1 contains an unquoted service path vulnerability that allows local non-privileged users to poten

APC Network Management Card 4 contains a path traversal vulnerability that allows unauthenticated attackers to access se

minaliC 2.0.0 contains a denial of service vulnerability that allows remote attackers to crash the web server by sending

FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject

FoF Pretty Mail 1.1.2 contains a local file inclusion vulnerability that allows administrative users to include arbitrar

Purei CMS 1.0 contains a time-based blind SQL injection vulnerability that allows attackers to manipulate database queri

Siklu MultiHaul TG series devices before version 2.0.0 contain an unauthenticated vulnerability that allows remote attac

Compuware iStrobe Web 20.13 contains a pre-authentication remote code execution vulnerability that allows unauthenticate

CE Phoenix v3.0.1 contains a stored cross-site scripting vulnerability in the currencies administration panel that allow

ElkArte Forum 1.1.9 contains a remote code execution vulnerability that allows authenticated administrators to upload ma

Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to exec

XMB Forum 1.9.12.06 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to

Flatboard 3.2 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject ma

Xhibiter NFT Marketplace 1.10.2 contains a SQL injection vulnerability in the collections endpoint that allows attackers

Genexus Protection Server 9.7.2.10 contains an unquoted service path vulnerability in the protsrvservice Windows service

dizqueTV 1.5.3 contains a remote code execution vulnerability that allows attackers to inject arbitrary commands through

Multiple constant-time implementations in wolfSSL before version 5.8.4 may be transformed into non-constant-time binary

Ibexa is a composable end-to-end DXP (Digital Experience Platform). Versions 5.0.0-beta1 through 5.0.3 do not have passw

Form.io is a combined Form and API platform for Serverless applications. Versions 3.5.6 and below and 4.0.0-rc.1 through

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions prior to 16.0.96 and

BrightSign Digital Signage Diagnostic Web Server 8.2.26 and less contains an unauthenticated server-side request forgery