2025

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_rndis: Refactor bind path to use __f

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_acm: Refactor bind path to use __fre

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ecm: Refactor bind path to use __fre

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: Refactor bind path to use __fre

In the Linux kernel, the following vulnerability has been resolved: ixgbe: fix too early devlink_free() in ixgbe_remove

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix recursive locking in RPC handle list acc

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Add check for no entries in cxl_featu

In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplus_str

In the Linux kernel, the following vulnerability has been resolved: NFSD: Define a proc_layoutcommit for the FlexFiles

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't allow evicting of BOs in same VM in a

A vulnerability exists in Progress Flowmon versions prior 12.5.6 where certain system configuration files have incorrect

The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to unauthorized access of data due to a missing

A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup. The soft

A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error

The Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue plugin for WordPress is vulnerable to log

The NS Maintenance Mode for WP WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which c

The Translate WordPress and go Multilingual – Weglot plugin for WordPress is vulnerable to unauthorized loss of data due

A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCom

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blocksy_newsle

Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.

Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Lifera

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme

Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing.This issue affects Civ

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Umami Analy

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Currency allows Cross Site Request Forgery.This issue affects

Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Co

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This is

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible t

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal JSON Field

The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsi

The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the n

The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affe

When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols

Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that as

Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with

Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By s

Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A mal

Cryptographic validation of upgrade images could be circumventing by dropping a specifically crafted file into the upgra

On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user

On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) mult

On affected platforms, restricted users could use SSH port forwarding to access host-internal services

On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privil

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component

Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebR

Prior to September 19, 2025, the Hospital Manager Backend Services exposed the ASP.NET tracing endpoint /trace.axd witho

Razer Synapse 3 Chroma Connect Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local

Razer Synapse 3 RazerPhilipsHueUninstall Link Following Local Privilege Escalation Vulnerability. This vulnerability all

Razer Synapse 3 Macro Module Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local at