2025

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix crypto buffers in non-linear memor

In the Linux kernel, the following vulnerability has been resolved: bpf: Skip scalar adjustment for BPF_NEG if dst is a

In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix uninit-value in squashfs_get_parent

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race condition in kprobe initializatio

In the Linux kernel, the following vulnerability has been resolved: fbdev: simplefb: Fix use after free in simplefb_det

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix possible map leak in fastrpc_put

In the Linux kernel, the following vulnerability has been resolved: Input: uinput - zero-initialize uinput_ff_upload_co

In the Linux kernel, the following vulnerability has been resolved: PCI/AER: Avoid NULL pointer dereference in aer_rate

In the Linux kernel, the following vulnerability has been resolved: remoteproc: pru: Fix potential NULL pointer derefer

In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-epf-test: Add NULL check for DMA

In the Linux kernel, the following vulnerability has been resolved: tee: fix register_shm_helper() In register_shm_hel

In the Linux kernel, the following vulnerability has been resolved: pinctrl: check the return value of pinmux_ops::get_

In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: Check return value of platform_get_res

microCLAUDIA in v3.2.0 and prior has an improper access control vulnerability. This flaw allows an authenticated user t

Improper locking vulnerability in Softing Industrial Automation GmbH gateways allows infected memory and/or resource lea

Webserver crash caused by scanning on TCP port 80 in Softing Industrial Automation GmbH gateways and switch.This issue a

Docker Compose trusts the path information embedded in remote OCI compose artifacts. When a layer includes the annotatio

Constellation is the first Confidential Kubernetes. The Constellation CVM image uses LUKS2-encrypted volumes for persist

Wimi Teamwork versions prior to 7.38.17 contains a cross-site request forgery (CSRF) vulnerability in its API. The API a

Rox, the software running BeWelcome, contains a PHP object injection vulnerability resulting from deserialization of unt

Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate a

Docker Desktop Installer.exe is vulnerable to DLL hijacking due to insecure DLL search order. The installer searches for

SQL injection vulnerability in the DRED virtual campus platform. This vulnerability allows an attacker to retrieve, crea

Incorrect validation of OCSP certificates vulnerability in TheGreenBow VPN, versions 7.5 and 7.6. During the IKEv2 authe

On Wear OS devices, when Google Messages is configured as the default SMS/MMS/RCS application, the handling of ACTION_SE

Stored cross-site scripting (XSS) vulnerability in the LMT Dashboard of the Perx Customer Engagement & Loyalty Platform

Deck Mate 1 executes firmware directly from an external EEPROM without verifying authenticity or integrity. An attacker

Deck Mate 2 lacks a verified secure-boot chain and runtime integrity validation for its controller and display modules.

Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them wit

Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips

An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable

GN4 Publishing System versions prior to 2.6 contain an insecure direct object reference (IDOR) vulnerability via the API

Karmada Dashboard is a general-purpose, web-based control panel for Karmada which is a multi-cluster management project.

A SQL injection vulnerability has been identified in DobryCMS. Improper neutralization of input provided by user into la

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Don't expose sysfs attributes not applic

In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix incorrect boolean values in af

In the Linux kernel, the following vulnerability has been resolved: tracing: dynevent: Add a missing lockdown check on

In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: fix shift-out-of-bounds issue Expli

In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-p

The Request Tracker software is vulnerable to a Stored XSS vulnerability in calendar invitation parsing feature, which d

Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authenticati

Tibbo AggreGate Network Manager < 6.40.05 exposes sensitive system information through an unauthenticated endpoint at /c

Tibbo AggreGate Network Manager < 6.40.05 contains an observable response discrepancy in its login functionality. Authen

An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switch

Cross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attac

Open redirection vulnerability in MOLGENIS EMX2 v11.14.0. This vulnerability allows an attacker to create a malicious UR

BookLore is a self-hosted web app for organizing and managing personal book collections. In versions 1.8.1 and prior, an

VDO.Ninja is a tool that brings remote video feeds into OBS or other studio software via WebRTC. From versions 28.0 to b

aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimed