Latest CVE Feed
-
0.0
NACVE-2025-39846
In the Linux kernel, the following vulnerability has been resolved: pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() In __iodyn_find_io_region(), pcmcia_make_resource() is assigned to res and used in pci_bus_alloc_resource(). There is ... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
9.3
CRITICALCVE-2025-34199
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.1049 and Application versions prior to 20.0.2786 (VA and SaaS deployments) contain insecure defaults and code patterns that disable TLS/SSL certificate verification for com... Read more
Affected Products :- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Misconfiguration
-
5.5
MEDIUMCVE-2025-10759
A vulnerability was detected in Webkul QloApps up to 1.7.0. This affects an unknown function of the component CSRF Token Handler. Performing manipulation of the argument token results in authorization bypass. The attack may be initiated remotely. The expl... Read more
Affected Products : qloapps- Published: Sep. 21, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Authorization
-
0.0
NACVE-2025-39839
In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix OOB read/write in network-coding decode batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packe... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
0.0
NACVE-2025-39855
In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL access of tx->in_use in ice_ptp_ts_irq The E810 device has support for a "low latency" firmware interface to access and read the Tx timestamps. This interface does not use... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
9.3
CRITICALCVE-2022-4980
General Bytes Crypto Application Server (CAS) beginning with version 20201208 prior to 20220531.38 (backport) and 20220725.22 (mainline) contains an authentication bypass in the admin web interface. An unauthenticated attacker could invoke the same URL us... Read more
Affected Products :- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Authentication
-
0.0
NACVE-2025-39857
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() BUG: kernel NULL pointer dereference, address: 00000000000002ec PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 28 U... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
2.9
LOWCVE-2025-59427
The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directo... Read more
Affected Products :- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Information Disclosure
-
0.0
NACVE-2025-39860
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and tou... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Race Condition
-
6.5
MEDIUMCVE-2025-10760
A flaw has been found in Harness 3.3.0. This impacts the function LookupRepo of the file app/api/controller/gitspace/lookup_repo.go. Executing manipulation of the argument url can lead to server-side request forgery. The attack may be launched remotely. T... Read more
Affected Products :- Published: Sep. 21, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Server-Side Request Forgery
-
6.5
MEDIUMCVE-2025-57396
Tandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vulnerable to privilege escalation. This is due to the rework of the API, which resulted in the User Profile API Endpoint containing two boolean values indicating whether a user is staff or adminis... Read more
Affected Products :- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Authorization
-
4.8
MEDIUMCVE-2025-10758
A security vulnerability has been detected in htmly up to 3.1.0. The impacted element is an unknown function of the file /htmly/admin/field/post of the component Custom Field Handler. Such manipulation of the argument label leads to cross site scripting. ... Read more
Affected Products :- Published: Sep. 21, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Cross-Site Scripting
-
0.0
NACVE-2025-39865
In the Linux kernel, the following vulnerability has been resolved: tee: fix NULL pointer dereference in tee_shm_put tee_shm_put have NULL pointer dereference: __optee_disable_shm_cache --> shm = reg_pair_to_ptr(...);//shm maybe return NULL te... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
4.9
MEDIUMCVE-2025-10002
The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to SQL Injection via the export_csv() function in all versions up to, and including, 2.5.0 due to insufficient escaping on ... Read more
Affected Products : clickwhale- Published: Sep. 20, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Injection
-
9.8
CRITICALCVE-2025-6544
A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited... Read more
- Published: Sep. 21, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Information Disclosure
-
8.9
HIGHCVE-2025-59431
MapServer is a system for developing web-based GIS applications. Prior to 8.4.1, the XML Filter Query directive PropertyName is vulnerably to Boolean-based SQL injection. It seems like expression checking is bypassed by introducing double quote characters... Read more
Affected Products : mapserver- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Injection
-
0.0
NACVE-2025-39863
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work The brcmf_btcoex_detach() only shuts down the btcoex timer, if the flag timer_on is false. However, the brcmf... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Race Condition
-
0.0
NACVE-2025-39866
In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when __mark_inode_dirty() get the bdi_writeback that was in the progress of switching. CPU: 1... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Race Condition
-
0.0
NACVE-2025-39861
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: vhci: Prevent use-after-free by removing debugfs files early Move the creation of debugfs files into a dedicated function, and ensure they are explicitly removed during vhci_... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
6.3
MEDIUMCVE-2025-55910
CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php.... Read more
Affected Products :- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Path Traversal