Latest CVE Feed
-
5.3
MEDIUMCVE-2025-41716
The web application allows an unauthenticated remote attacker to learn information about existing user accounts with their corresponding role due to missing authentication for critical function.... Read more
Affected Products :- Published: Sep. 24, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Authentication
-
8.7
HIGHCVE-2025-10244
A maliciously crafted HTML payload, when rendered by the Autodesk Fusion desktop application, can trigger a Stored Cross-site Scripting (XSS) vulnerability. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in... Read more
Affected Products : fusion- Published: Sep. 23, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Cross-Site Scripting
-
0.0
NACVE-2024-58241
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Disable works on hci_unregister_dev This make use of disable_work_* on hci_unregister_dev since the hci_dev is about to be freed new submissions are not disarable.... Read more
Affected Products : linux_kernel- Published: Sep. 24, 2025
- Modified: Sep. 24, 2025
-
8.8
HIGHCVE-2025-20334
A vulnerability in the HTTP API subsystem of Cisco IOS XE Software could allow a remote attacker to inject commands that will execute with root privileges into the underlying operating system. This vulnerability is due to insufficient input validation.... Read more
Affected Products : ios_xe- Published: Sep. 24, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Injection
-
9.8
CRITICALCVE-2025-26399
SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass ... Read more
Affected Products : web_help_desk- Published: Sep. 23, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Injection
-
3.3
LOWCVE-2025-23308
NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvdisasm where an attacker may cause a heap-based buffer overflow by getting the user to run nvdisasm on a malicious ELF file. A successful exploit of this vulnerability may lead to arbitra... Read more
Affected Products : cuda_toolkit- Published: Sep. 24, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Memory Corruption
-
6.9
MEDIUMCVE-2025-43779
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay... Read more
- Published: Sep. 24, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Cross-Site Scripting
-
3.3
LOWCVE-2025-23339
NVIDIA CUDA Toolkit for all platforms contains a vulnerability in cuobjdump where an attacker may cause a stack-based buffer overflow by getting the user to run cuobjdump on a malicious ELF file. A successful exploit of this vulnerability may lead to arbi... Read more
Affected Products : cuda_toolkit- Published: Sep. 24, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Memory Corruption
-
8.8
HIGHCVE-2025-9900
A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick... Read more
Affected Products :- Published: Sep. 23, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Memory Corruption
-
9.8
CRITICALCVE-2025-27034
Memory corruption while selecting the PLMN from SOR failed list.... Read more
Affected Products :- Published: Sep. 24, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Memory Corruption
-
3.3
LOWCVE-2025-23255
NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary where a user may cause an out-of-bounds read by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability may lead to a partial denial of se... Read more
Affected Products : cuda_toolkit- Published: Sep. 24, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Information Disclosure
-
0.0
NACVE-2025-39879
In the Linux kernel, the following vulnerability has been resolved: ceph: always call ceph_shift_unused_folios_left() The function ceph_process_folio_batch() sets folio_batch entries to NULL, which is an illegal state. Before folio_batch_release() cras... Read more
Affected Products : linux_kernel- Published: Sep. 23, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Memory Corruption
-
5.3
MEDIUMCVE-2025-59547
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, the CKEditor file upload endpoint has insufficient sanitization for filenames allowing probing network endpoints. A spec... Read more
Affected Products : dotnetnuke- Published: Sep. 23, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Path Traversal
-
4.3
MEDIUMCVE-2025-58246
Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability.... Read more
Affected Products :- Published: Sep. 23, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Information Disclosure
-
0.0
NACVE-2025-39885
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive semaphore deadlock in fiemap call syzbot detected a OCFS2 hang due to a recursive semaphore on a FS_IOC_FIEMAP of the extent list on a specially crafted mmap file. ... Read more
Affected Products : linux_kernel- Published: Sep. 23, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Race Condition
-
0.0
NACVE-2025-39880
In the Linux kernel, the following vulnerability has been resolved: libceph: fix invalid accesses to ceph_connection_v1_info There is a place where generic code in messenger.c is reading and another place where it is writing to con->v1 union member with... Read more
Affected Products : linux_kernel- Published: Sep. 23, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Memory Corruption
-
0.0
NACVE-2025-39884
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix subvolume deletion lockup caused by inodes xarray race There is a race condition between inode eviction and inode caching that can cause a live struct btrfs_inode to be missi... Read more
Affected Products : linux_kernel- Published: Sep. 23, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Race Condition
-
0.0
NACVE-2025-39878
In the Linux kernel, the following vulnerability has been resolved: ceph: fix crash after fscrypt_encrypt_pagecache_blocks() error The function move_dirty_folio_in_page_array() was created by commit ce80b76dd327 ("ceph: introduce ceph_process_folio_batc... Read more
Affected Products : linux_kernel- Published: Sep. 23, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Memory Corruption
-
0.0
NACVE-2025-39877
In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: fix use-after-free in state_show() state_show() reads kdamond->damon_ctx without holding damon_sysfs_lock. This allows a use-after-free race: CPU 0 ... Read more
Affected Products : linux_kernel- Published: Sep. 23, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Race Condition
-
0.0
NACVE-2025-39876
In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() The function of_phy_find_device may return NULL, so we need to take care before dereferencing phy_dev.... Read more
Affected Products : linux_kernel- Published: Sep. 23, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Misconfiguration