Latest CVE Feed
-
6.3
MEDIUMCVE-2025-10772
A vulnerability was identified in huggingface LeRobot up to 0.3.3. Affected by this vulnerability is an unknown functionality of the file lerobot/common/robot_devices/robots/lekiwi_remote.py of the component ZeroMQ Socket Handler. The manipulation leads t... Read more
Affected Products :- Published: Sep. 22, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Authentication
-
0.0
NACVE-2025-39848
In the Linux kernel, the following vulnerability has been resolved: ax25: properly unshare skbs in ax25_kiss_rcv() Bernard Pidoux reported a regression apparently caused by commit c353e8983e0d ("net: introduce per netns packet chains"). skb->dev become... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
6.5
MEDIUMCVE-2025-10652
The Robcore Netatmo plugin for WordPress is vulnerable to SQL Injection via the ‘module_id’ attribute of the robcore-netatmo shortcode in all versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter and lack of suffic... Read more
Affected Products :- Published: Sep. 20, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Injection
-
9.0
HIGHCVE-2025-10756
A security flaw has been discovered in UTT HiPER 840G up to 3.1.1-190328. Impacted is an unknown function of the file /goform/getOneApConfTempEntry. The manipulation of the argument tempName results in buffer overflow. It is possible to launch the attack ... Read more
Affected Products :- Published: Sep. 20, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
6.5
MEDIUMCVE-2025-10768
A flaw has been found in h2oai h2o-3 up to 3.46.08. The impacted element is an unknown function of the file /99/ImportSQLTable of the component IBMDB2 JDBC Driver. This manipulation of the argument connection_url causes deserialization. The attack may be ... Read more
Affected Products : h2o- Published: Sep. 21, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Misconfiguration
-
5.3
MEDIUMCVE-2025-10766
A weakness has been identified in SeriaWei ZKEACMS up to 4.3. This issue affects the function Download of the file EventViewerController.cs. Executing manipulation of the argument ID can lead to path traversal. It is possible to launch the attack remotely... Read more
Affected Products :- Published: Sep. 21, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Path Traversal
-
0.0
NACVE-2025-39863
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work The brcmf_btcoex_detach() only shuts down the btcoex timer, if the flag timer_on is false. However, the brcmf... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Race Condition
-
0.0
NACVE-2025-39838
In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL pointer dereference in UTF16 conversion There can be a NULL pointer dereference bug here. NULL is passed to __cifs_sfu_make_node without checks, which passes it unche... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
0.0
NACVE-2025-39843
In the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up kswapd in set_track_prepare set_track_prepare() can incur lock recursion. The issue is that it is called from hrtimer_start_range_ns holding the per_cpu(hrtimer_... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Race Condition
-
0.0
NACVE-2025-39852
In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 When tcp_ao_copy_all_matching() fails in tcp_v6_syn_recv_sock() it just exits the function. This ends up causing a me... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
4.3
MEDIUMCVE-2025-10489
The SureForms – Drag and Drop Contact Form Builder – Multi-step Forms, Conversational Forms and more plugin for WordPress is vulnerable to unauthorized creation of forms due to a missing capability check on the register_post_types() function in all versio... Read more
Affected Products :- Published: Sep. 20, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Authorization
-
0.0
NACVE-2025-39864
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-free in cmp_bss() Following bss_free() quirk introduced in commit 776b3580178f ("cfg80211: track hidden SSID networks properly"), adjust cfg80211_update_kn... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
5.4
MEDIUMCVE-2025-36248
IBM Copy Services Manager 6.3.13 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure... Read more
Affected Products : copy_services_manager- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Cross-Site Scripting
-
8.0
HIGHCVE-2025-9079
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepacka... Read more
Affected Products : mattermost_server- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Misconfiguration
-
0.0
NACVE-2025-39851
In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object VXLAN FDB entries can point to either a remote destination or an FDB nexthop group. The latter is usually used in EVPN ... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Misconfiguration
-
0.0
NACVE-2025-39856
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix null pointer dereference for ndev In the TX completion packet stage of TI SoCs with CPSW2G instance, which has single external ethernet port, ndev... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
0.0
NACVE-2025-39850
In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects When the "proxy" option is enabled on a VXLAN device, the device will suppress ARP requests and IPv6 Neighbor Solicitat... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Denial of Service
-
6.9
MEDIUMCVE-2025-43808
The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and 7.3 service pack 3 through update 35 saves virtual products uploaded to Documents an... Read more
- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Authorization
-
4.3
MEDIUMCVE-2025-9887
The Custom Login And Signup Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation in the /frndzk_adminclsw.php file. This makes it possible f... Read more
Affected Products :- Published: Sep. 20, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Cross-Site Request Forgery
-
0.0
NACVE-2025-39844
In the Linux kernel, the following vulnerability has been resolved: mm: move page table sync declarations to linux/pgtable.h During our internal testing, we started observing intermittent boot failures when the machine uses 4-level paging and has a larg... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption