Latest CVE Feed
-
7.3
HIGHCVE-2025-9966
Improper privilege management vulnerability in Novakon P series allows attackers to gain root privileges if one service is compromized.This issue affects P series: P – V2001.A.C518o2.... Read more
Affected Products :- Published: Sep. 23, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Authorization
-
0.0
NACVE-2025-39887
In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Fix null-ptr-deref in bitmap_parselist() A crash was observed with the following output: BUG: kernel NULL pointer dereference, address: 0000000000000010 Oops: Oops: 00... Read more
Affected Products : linux_kernel- Published: Sep. 23, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Memory Corruption
-
6.1
MEDIUMCVE-2025-8282
The SureForms WordPress plugin before 1.9.1 does not sanitise and escape some parameters when outputing them in the page, which could allow admin and above users to perform Cross-Site Scripting attacks.... Read more
Affected Products : sureforms- Published: Sep. 23, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Cross-Site Scripting
-
0.0
NACVE-2025-39871
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Remove improper idxd_free The call to idxd_free() introduces a duplicate put_device() leading to a reference count underflow: refcount_t: underflow; use-after-free. WAR... Read more
Affected Products : linux_kernel- Published: Sep. 23, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Memory Corruption
-
0.0
NACVE-2025-39886
In the Linux kernel, the following vulnerability has been resolved: bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() Currently, calling bpf_map_kmalloc_node() from __bpf_async_init() can cause various locking issues; see the followin... Read more
Affected Products : linux_kernel- Published: Sep. 23, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Race Condition
-
0.0
NACVE-2025-39888
In the Linux kernel, the following vulnerability has been resolved: fuse: Block access to folio overlimit syz reported a slab-out-of-bounds Write in fuse_dev_do_write. When the number of bytes to be retrieved is truncated to the upper limit by fc->max_... Read more
Affected Products : linux_kernel- Published: Sep. 23, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Memory Corruption
-
0.0
NACVE-2025-39879
In the Linux kernel, the following vulnerability has been resolved: ceph: always call ceph_shift_unused_folios_left() The function ceph_process_folio_batch() sets folio_batch entries to NULL, which is an illegal state. Before folio_batch_release() cras... Read more
Affected Products : linux_kernel- Published: Sep. 23, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Memory Corruption
-
0.0
NACVE-2025-39875
In the Linux kernel, the following vulnerability has been resolved: igb: Fix NULL pointer dereference in ethtool loopback test The igb driver currently causes a NULL pointer dereference when executing the ethtool loopback test. This occurs because there... Read more
Affected Products : linux_kernel- Published: Sep. 23, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Memory Corruption
-
0.0
NACVE-2025-39872
In the Linux kernel, the following vulnerability has been resolved: hsr: hold rcu and dev lock for hsr_get_port_ndev hsr_get_port_ndev calls hsr_for_each_port, which need to hold rcu lock. On the other hand, before return the port device, we need to hol... Read more
Affected Products : linux_kernel- Published: Sep. 23, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Race Condition
-
9.8
CRITICALCVE-2025-26399
SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass ... Read more
Affected Products : web_help_desk- Published: Sep. 23, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Injection
-
6.4
MEDIUMCVE-2025-9353
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 7.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated a... Read more
Affected Products : builder- Published: Sep. 24, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Cross-Site Scripting
-
5.8
MEDIUMCVE-2025-20339
A vulnerability in the access control list (ACL) processing of IPv4 packets of Cisco SD-WAN vEdge Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to the improper enforcement of the implicit... Read more
Affected Products : sd-wan_vedge_router- Published: Sep. 24, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Authorization
-
5.4
MEDIUMCVE-2025-57204
Stocky POS with Inventory Management & HRM (ui-lib) version 5.0 is affected by a Stored Cross-Site Scripting (XSS) vulnerability within the Products module available to authenticated users. The vulnerability resides in the product name parameter submitted... Read more
Affected Products :- Published: Sep. 22, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Cross-Site Scripting
-
8.8
HIGHCVE-2025-54376
Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same authentication middleware that guards the REST admin API. Consequently, an unauthenticated remot... Read more
Affected Products : hoverfly- Published: Sep. 10, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Authentication
-
5.4
MEDIUMCVE-2025-47910
When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler... Read more
Affected Products : go- Published: Sep. 22, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Misconfiguration
-
9.8
CRITICALCVE-2025-58142
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of guest memory pages in the viridian code: 1. A NULL point... Read more
Affected Products : xen- Published: Sep. 11, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Memory Corruption
-
9.8
CRITICALCVE-2025-58143
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of guest memory pages in the viridian code: 1. A NULL point... Read more
Affected Products : xen- Published: Sep. 11, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Memory Corruption
-
7.5
HIGHCVE-2025-58144
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are two issues related to the mapping of pages belonging to other domains: For one, an assertion is wrong there, where ... Read more
Affected Products : xen- Published: Sep. 11, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Memory Corruption
-
7.5
HIGHCVE-2025-58145
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are two issues related to the mapping of pages belonging to other domains: For one, an assertion is wrong there, where ... Read more
Affected Products : xen- Published: Sep. 11, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Memory Corruption
-
6.5
MEDIUMCVE-2025-58065
Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite ... Read more
- Published: Sep. 11, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Authentication