Latest CVE Feed
-
0.0
NACVE-2025-39859
In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog The ptp_ocp_detach() only shuts down the watchdog timer if it is pending. However, if the timer handler is already running,... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Race Condition
-
0.0
NACVE-2025-39842
In the Linux kernel, the following vulnerability has been resolved: ocfs2: prevent release journal inode after journal shutdown Before calling ocfs2_delete_osb(), ocfs2_journal_shutdown() has already been executed in ocfs2_dismount_volume(), so osb->jou... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
6.5
MEDIUMCVE-2025-57396
Tandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vulnerable to privilege escalation. This is due to the rework of the API, which resulted in the User Profile API Endpoint containing two boolean values indicating whether a user is staff or adminis... Read more
Affected Products :- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Authorization
-
5.3
MEDIUMCVE-2025-10718
A vulnerability was found in Ooma Office Business Phone App up to 7.2.2 on Android. This affects an unknown part of the component com.ooma.office2. The manipulation results in improper export of android application components. The attack needs to be appro... Read more
Affected Products :- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Misconfiguration
-
0.0
NACVE-2025-39852
In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 When tcp_ao_copy_all_matching() fails in tcp_v6_syn_recv_sock() it just exits the function. This ends up causing a me... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
0.0
NACVE-2025-39841
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the R... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
4.3
MEDIUMCVE-2025-10489
The SureForms – Drag and Drop Contact Form Builder – Multi-step Forms, Conversational Forms and more plugin for WordPress is vulnerable to unauthorized creation of forms due to a missing capability check on the register_post_types() function in all versio... Read more
Affected Products :- Published: Sep. 20, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Authorization
-
0.0
NACVE-2025-39857
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() BUG: kernel NULL pointer dereference, address: 00000000000002ec PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 28 U... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
6.5
MEDIUMCVE-2025-10760
A flaw has been found in Harness 3.3.0. This impacts the function LookupRepo of the file app/api/controller/gitspace/lookup_repo.go. Executing manipulation of the argument url can lead to server-side request forgery. The attack may be launched remotely. T... Read more
Affected Products :- Published: Sep. 21, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Server-Side Request Forgery
-
0.0
NACVE-2025-39855
In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL access of tx->in_use in ice_ptp_ts_irq The E810 device has support for a "low latency" firmware interface to access and read the Tx timestamps. This interface does not use... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
0.0
NACVE-2025-39853
In the Linux kernel, the following vulnerability has been resolved: i40e: Fix potential invalid access when MAC list is empty list_first_entry() never returns NULL - if the list is empty, it still returns a pointer to an invalid object, leading to poten... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
2.9
LOWCVE-2025-59427
The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directo... Read more
Affected Products :- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Information Disclosure
-
0.0
NACVE-2025-39839
In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix OOB read/write in network-coding decode batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packe... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
6.5
MEDIUMCVE-2025-10652
The Robcore Netatmo plugin for WordPress is vulnerable to SQL Injection via the ‘module_id’ attribute of the robcore-netatmo shortcode in all versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter and lack of suffic... Read more
Affected Products :- Published: Sep. 20, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Injection
-
9.0
HIGHCVE-2025-10756
A security flaw has been discovered in UTT HiPER 840G up to 3.1.1-190328. Impacted is an unknown function of the file /goform/getOneApConfTempEntry. The manipulation of the argument tempName results in buffer overflow. It is possible to launch the attack ... Read more
Affected Products :- Published: Sep. 20, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
6.5
MEDIUMCVE-2025-10768
A flaw has been found in h2oai h2o-3 up to 3.46.08. The impacted element is an unknown function of the file /99/ImportSQLTable of the component IBMDB2 JDBC Driver. This manipulation of the argument connection_url causes deserialization. The attack may be ... Read more
Affected Products : h2o- Published: Sep. 21, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Misconfiguration
-
6.3
MEDIUMCVE-2025-10772
A vulnerability was identified in huggingface LeRobot up to 0.3.3. Affected by this vulnerability is an unknown functionality of the file lerobot/common/robot_devices/robots/lekiwi_remote.py of the component ZeroMQ Socket Handler. The manipulation leads t... Read more
Affected Products :- Published: Sep. 22, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Authentication
-
7.7
HIGHCVE-2025-59344
AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery (SSRF) vulnerability exists in the favicon extraction feature of AliasVault API versions 0.23.0 and lower. The extractor fetches a user-supplied URL... Read more
Affected Products :- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Server-Side Request Forgery
-
0.0
NACVE-2025-39854
In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL access of tx->in_use in ice_ll_ts_intr Recent versions of the E810 firmware have support for an extra interrupt to handle report of the "low latency" Tx timestamps coming ... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
4.3
MEDIUMCVE-2025-9949
The Internal Links Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the link deletion functionality in the process_bulk_action() f... Read more
Affected Products :- Published: Sep. 20, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Cross-Site Request Forgery