Latest CVE Feed
-
6.1
MEDIUMCVE-2025-9882
The osTicket WP Bridge plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers t... Read more
Affected Products :- Published: Sep. 20, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Cross-Site Request Forgery
-
9.3
CRITICALCVE-2024-13990
MicroWorld eScan AV's update mechanism failed to ensure authenticity and integrity of updates: update packages were delivered and accepted without robust cryptographic verification. As a result, an on-path attacker could perform a man-in-the-middle (MitM)... Read more
Affected Products :- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Cryptography
-
6.9
MEDIUMCVE-2025-43803
Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update... Read more
- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Authorization
-
5.3
MEDIUMCVE-2025-56869
Directory traversal vulnerability in Sync In server thru 1.1.1 allowing authenticated attackers to gain read and write access to the system via FilesManager.saveMultipart function in backend/src/applications/files/services/files-manager.service.ts, and Fi... Read more
Affected Products :- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Path Traversal
-
9.3
CRITICALCVE-2022-4980
General Bytes Crypto Application Server (CAS) beginning with version 20201208 prior to 20220531.38 (backport) and 20220725.22 (mainline) contains an authentication bypass in the admin web interface. An unauthenticated attacker could invoke the same URL us... Read more
Affected Products :- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Authentication
-
5.3
MEDIUMCVE-2025-10721
A vulnerability was determined in Webull Investing & Trading App 11.2.5.63 on Android. This vulnerability affects unknown code of the file AndroidManifest.xml. This manipulation causes improper export of android application components. The attack can only... Read more
Affected Products :- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Misconfiguration
-
6.5
MEDIUMCVE-2025-10741
A security vulnerability has been detected in Selleo Mentingo up to 2025.08.27. The affected element is an unknown function of the component Profile Picture Handler. The manipulation of the argument userAvatar leads to unrestricted upload. The attack is p... Read more
Affected Products :- Published: Sep. 20, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Authentication
-
0.0
NACVE-2025-39853
In the Linux kernel, the following vulnerability has been resolved: i40e: Fix potential invalid access when MAC list is empty list_first_entry() never returns NULL - if the list is empty, it still returns a pointer to an invalid object, leading to poten... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
9.0
HIGHCVE-2025-10757
A weakness has been identified in UTT 1200GW up to 3.0.0-170831. The affected element is an unknown function of the file /goform/formConfigDnsFilterGlobal. This manipulation of the argument GroupName causes buffer overflow. The attack can be initiated rem... Read more
Affected Products :- Published: Sep. 21, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
4.8
MEDIUMCVE-2025-10758
A security vulnerability has been detected in htmly up to 3.1.0. The impacted element is an unknown function of the file /htmly/admin/field/post of the component Custom Field Handler. Such manipulation of the argument label leads to cross site scripting. ... Read more
Affected Products :- Published: Sep. 21, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Cross-Site Scripting
-
0.0
NACVE-2025-39866
In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when __mark_inode_dirty() get the bdi_writeback that was in the progress of switching. CPU: 1... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Race Condition
-
0.0
NACVE-2025-39863
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work The brcmf_btcoex_detach() only shuts down the btcoex timer, if the flag timer_on is false. However, the brcmf... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Race Condition
-
0.0
NACVE-2025-39857
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() BUG: kernel NULL pointer dereference, address: 00000000000002ec PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 28 U... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
0.0
NACVE-2025-39865
In the Linux kernel, the following vulnerability has been resolved: tee: fix NULL pointer dereference in tee_shm_put tee_shm_put have NULL pointer dereference: __optee_disable_shm_cache --> shm = reg_pair_to_ptr(...);//shm maybe return NULL te... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
0.0
NACVE-2025-39839
In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix OOB read/write in network-coding decode batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packe... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
6.1
MEDIUMCVE-2025-59689
Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG ... Read more
Affected Products :- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Injection
-
0.0
NACVE-2025-39855
In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL access of tx->in_use in ice_ptp_ts_irq The E810 device has support for a "low latency" firmware interface to access and read the Tx timestamps. This interface does not use... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
0.0
NACVE-2025-39851
In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object VXLAN FDB entries can point to either a remote destination or an FDB nexthop group. The latter is usually used in EVPN ... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Misconfiguration
-
0.0
NACVE-2025-39850
In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects When the "proxy" option is enabled on a VXLAN device, the device will suppress ARP requests and IPv6 Neighbor Solicitat... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Denial of Service
-
0.0
NACVE-2025-39856
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix null pointer dereference for ndev In the TX completion packet stage of TI SoCs with CPSW2G instance, which has single external ethernet port, ndev... Read more
Affected Products : linux_kernel- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption