Latest CVE Feed
-
7.3
HIGHCVE-2025-55912
An issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in photo_uploader.php to upload arbitrary files without any authentication, due to missing access controls in the upload handler... Read more
Affected Products :- Published: Sep. 18, 2025
- Modified: Sep. 19, 2025
- Vuln Type: Authentication
-
6.5
MEDIUMCVE-2025-47906
If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.... Read more
Affected Products : go- Published: Sep. 18, 2025
- Modified: Sep. 19, 2025
- Vuln Type: Path Traversal
-
9.8
CRITICALCVE-2025-54807
The secret used for validating authentication tokens is hardcoded in device firmware for affected versions. An attacker who obtains the signing key can bypass authentication, gaining complete access to the system.... Read more
Affected Products :- Published: Sep. 18, 2025
- Modified: Sep. 19, 2025
- Vuln Type: Authentication
-
7.3
HIGHCVE-2025-59424
LinkAce is a self-hosted archive to collect website links. Prior to 2.3.1, a Stored Cross-Site Scripting (XSS) vulnerability has been identified on the /system/audit page. The application fails to properly sanitize the username field before it is rendered... Read more
Affected Products :- Published: Sep. 18, 2025
- Modified: Sep. 19, 2025
- Vuln Type: Cross-Site Scripting
-
0.0
NACVE-2023-53445
In the Linux kernel, the following vulnerability has been resolved: net: qrtr: Fix a refcount bug in qrtr_recvmsg() Syzbot reported a bug as following: refcount_t: addition on 0; use-after-free. ... RIP: 0010:refcount_warn_saturate+0x17c/0x1f0 lib/refc... Read more
Affected Products : linux_kernel- Published: Sep. 18, 2025
- Modified: Sep. 19, 2025
- Vuln Type: Memory Corruption
-
0.0
NACVE-2023-53446
In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free Struct pcie_link_state->downstream is a pointer to the pci_dev of function 0. Previously we retained that pointer... Read more
Affected Products : linux_kernel- Published: Sep. 18, 2025
- Modified: Sep. 19, 2025
- Vuln Type: Memory Corruption
-
8.8
HIGHCVE-2025-55068
Dover Fueling Solutions ProGauge MagLink LX4 Devices fail to handle Unix time values beyond a certain point. An attacker can manually change the system time to exploit this limitation, potentially causing errors in authentication and leading to a denia... Read more
Affected Products :- Published: Sep. 18, 2025
- Modified: Sep. 19, 2025
- Vuln Type: Authentication
-
8.1
HIGHCVE-2025-5955
The Service Finder SMS System plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.0. This is due to the plugin not verifying a user's phone number before logging them in. This makes it possible for unauthe... Read more
Affected Products :- Published: Sep. 19, 2025
- Modified: Sep. 19, 2025
- Vuln Type: Authentication
-
0.0
NACVE-2023-53447
In the Linux kernel, the following vulnerability has been resolved: f2fs: don't reset unchangable mount option in f2fs_remount() syzbot reports a bug as below: general protection fault, probably for non-canonical address 0xdffffc0000000009: 0000 [#1] P... Read more
Affected Products : linux_kernel- Published: Sep. 18, 2025
- Modified: Sep. 19, 2025
- Vuln Type: Race Condition
-
0.0
NACVE-2023-53375
In the Linux kernel, the following vulnerability has been resolved: tracing: Free error logs of tracing instances When a tracing instance is removed, the error messages that hold errors that occurred in the instance needs to be freed. The following repo... Read more
Affected Products : linux_kernel- Published: Sep. 18, 2025
- Modified: Sep. 19, 2025
- Vuln Type: Memory Corruption
-
4.3
MEDIUMCVE-2025-59040
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Backlog item representations do not verify the permissions of the child trackers. Users might see tracker names they should not have access to. This vulnerabi... Read more
Affected Products : tuleap- Published: Sep. 18, 2025
- Modified: Sep. 19, 2025
- Vuln Type: Authorization
-
0.0
NACVE-2023-53443
In the Linux kernel, the following vulnerability has been resolved: mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak In arizona_clk32k_enable(), we should use pm_runtime_resume_and_get() as pm_runtime_get_sync() will increase the ref... Read more
Affected Products : linux_kernel- Published: Sep. 18, 2025
- Modified: Sep. 19, 2025
-
0.0
NACVE-2023-53371
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix memory leak in mlx5e_fs_tt_redirect_any_create The memory pointed to by the fs->any pointer is not freed in the error path of mlx5e_fs_tt_redirect_any_create, which can l... Read more
Affected Products : linux_kernel- Published: Sep. 18, 2025
- Modified: Sep. 19, 2025
- Vuln Type: Memory Corruption
-
0.0
NACVE-2022-50397
In the Linux kernel, the following vulnerability has been resolved: net/ieee802154: reject zero-sized raw_sendmsg() syzbot is hitting skb_assert_len() warning at raw_sendmsg() for ieee802154 socket. What commit dc633700f00f726e ("net/af_packet: check le... Read more
Affected Products : linux_kernel- Published: Sep. 18, 2025
- Modified: Sep. 19, 2025
- Vuln Type: Denial of Service
-
0.0
NACVE-2022-50398
In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: add atomic_check to bridge ops DRM commit_tails() will disable downstream crtc/encoder/bridge if both disable crtc is required and crtc->active is set before pushing a new f... Read more
Affected Products : linux_kernel- Published: Sep. 18, 2025
- Modified: Sep. 19, 2025
- Vuln Type: Denial of Service
-
0.0
NACVE-2022-50399
In the Linux kernel, the following vulnerability has been resolved: media: atomisp: prevent integer overflow in sh_css_set_black_frame() The "height" and "width" values come from the user so the "height * width" multiplication can overflow.... Read more
Affected Products : linux_kernel- Published: Sep. 18, 2025
- Modified: Sep. 19, 2025
-
0.0
NACVE-2023-53372
In the Linux kernel, the following vulnerability has been resolved: sctp: fix a potential overflow in sctp_ifwdtsn_skip Currently, when traversing ifwdtsn skips with _sctp_walk_ifwdtsn, it only checks the pos against the end of the chunk. However, the d... Read more
Affected Products : linux_kernel- Published: Sep. 18, 2025
- Modified: Sep. 19, 2025
- Vuln Type: Memory Corruption
-
0.0
NACVE-2022-50394
In the Linux kernel, the following vulnerability has been resolved: i2c: ismt: Fix an out-of-bounds bug in ismt_access() When the driver does not check the data from the user, the variable 'data->block[0]' may be very large to cause an out-of-bounds bug... Read more
Affected Products : linux_kernel- Published: Sep. 18, 2025
- Modified: Sep. 19, 2025
- Vuln Type: Memory Corruption
-
8.8
HIGHCVE-2025-57293
A command injection vulnerability in COMFAST CF-XR11 (firmware V2.7.2) exists in the multi_pppoe API, processed by the sub_423930 function in /usr/bin/webmgnt. The phy_interface parameter is not sanitized, allowing attackers to inject arbitrary commands v... Read more
Affected Products :- Published: Sep. 18, 2025
- Modified: Sep. 19, 2025
- Vuln Type: Injection
-
0.0
NACVE-2022-50400
In the Linux kernel, the following vulnerability has been resolved: staging: greybus: audio_helper: remove unused and wrong debugfs usage In the greybus audio_helper code, the debugfs file for the dapm has the potential to be removed and memory will be ... Read more
Affected Products : linux_kernel- Published: Sep. 18, 2025
- Modified: Sep. 19, 2025
- Vuln Type: Misconfiguration