Latest CVE Feed
-
5.3
MEDIUMCVE-2025-11171
The Chartify – WordPress Chart Plugin for WordPress is vulnerable to Missing Authentication for Critical Function in all versions up to, and including, 3.5.9. This is due to the plugin registering an unauthenticated AJAX action that dispatches to admin-cl... Read more
Affected Products : chartify- Published: Oct. 08, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Authentication
-
0.0
NACVE-2023-53664
In the Linux kernel, the following vulnerability has been resolved: OPP: Fix potential null ptr dereference in dev_pm_opp_get_required_pstate() "opp" pointer is dereferenced before the IS_ERR_OR_NULL() check. Fix it by removing the dereference to cache ... Read more
Affected Products : linux_kernel- Published: Oct. 07, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Memory Corruption
-
0.0
NACVE-2023-53666
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd938x: fix missing mbhc init error handling MBHC initialisation can fail so add the missing error handling to avoid dereferencing an error pointer when later configuring... Read more
Affected Products : linux_kernel- Published: Oct. 07, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Misconfiguration
-
0.0
NACVE-2023-53670
In the Linux kernel, the following vulnerability has been resolved: nvme-core: fix dev_pm_qos memleak Call dev_pm_qos_hide_latency_tolerance() in the error unwind patch to avoid following kmemleak:- blktests (master) # kmemleak-clear; ./check nvme/044;... Read more
Affected Products : linux_kernel- Published: Oct. 07, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Memory Corruption
-
4.8
MEDIUMCVE-2025-43822
Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 15 through update 92 allow remote attackers to inject arbitra... Read more
- Published: Oct. 07, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Cross-Site Scripting
-
4.8
MEDIUMCVE-2025-43823
Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4 before patch 6, 2023.Q3 before patch 9, and 7.4 GA through update 92 allows remote attackers to inject arbitra... Read more
- Published: Oct. 07, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Cross-Site Scripting
-
0.0
NACVE-2023-53672
In the Linux kernel, the following vulnerability has been resolved: btrfs: output extra debug info if we failed to find an inline backref [BUG] Syzbot reported several warning triggered inside lookup_inline_extent_backref(). [CAUSE] As usual, the repro... Read more
Affected Products : linux_kernel- Published: Oct. 07, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Misconfiguration
-
6.5
MEDIUMCVE-2025-11407
A weakness has been identified in D-Link DI-7001 MINI 24.04.18B1. Impacted is an unknown function of the file /upgrade_filter.asp. This manipulation of the argument path causes os command injection. The attack may be initiated remotely. The exploit has be... Read more
Affected Products :- Published: Oct. 07, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Injection
-
7.5
HIGHCVE-2025-61910
The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A BPv7 bundle with a malformed extension block causes uncontrolled memory allocation inside ION-DTN 4.1.3s, leading to receiver thread term... Read more
Affected Products :- Published: Oct. 07, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Denial of Service
-
0.0
NACVE-2023-53677
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix memory leaks in i915 selftests This patch fixes memory leaks on error escapes in function fake_get_pages (cherry picked from commit 8bfbdadce85c4c51689da10f39c805a7106d45... Read more
Affected Products : linux_kernel- Published: Oct. 07, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Memory Corruption
-
0.0
NACVE-2023-53678
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix system suspend without fbdev being initialized If fbdev is not initialized for some reason - in practice on platforms without display - suspending fbdev should be skipped ... Read more
Affected Products : linux_kernel- Published: Oct. 07, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Misconfiguration
-
0.0
NACVE-2023-53681
In the Linux kernel, the following vulnerability has been resolved: bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent In some specific situations, the return value of __bch_btree_node_alloc may be NULL. This may lead to a potent... Read more
Affected Products : linux_kernel- Published: Oct. 07, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Memory Corruption
-
0.0
NACVE-2023-53687
In the Linux kernel, the following vulnerability has been resolved: tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk When the best clk is searched, we iterate over all possible clk. If we find a better match, th... Read more
Affected Products : linux_kernel- Published: Oct. 07, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Memory Corruption
-
9.8
CRITICALCVE-2025-52021
A SQL Injection vulnerability exists in the edit_product.php file of PuneethReddyHC Online Shopping System Advanced 1.0. The product_id GET parameter is unsafely passed to a SQL query without proper validation or parameterization.... Read more
Affected Products :- Published: Oct. 07, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Injection
-
8.1
HIGHCVE-2025-10494
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation when deleting profile pictures in all versions up to, and including, 1.4.89. This makes it poss... Read more
Affected Products : motors_-_car_dealer\,_classifieds_\&_listing- Published: Oct. 08, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Path Traversal
-
9.3
CRITICALCVE-2025-10351
SQL injection vulnerability based on the melis-cms module of the Melis platform from Melis Technology. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'idPage' parameter in the '/melis/MelisCms/PageEditi... Read more
Affected Products : meliscms- Published: Oct. 08, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Injection
-
9.3
CRITICALCVE-2025-10352
Vulnerability in the melis-core module of Melis Technology's Melis Platform, which, if exploited, allows an unauthenticated attacker to create an administrator account via a request to '/melis/MelisCore/ToolUser/addNewUser'.... Read more
Affected Products :- Published: Oct. 08, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Authentication
-
0.0
NACVE-2023-53661
In the Linux kernel, the following vulnerability has been resolved: bnxt: avoid overflow in bnxt_get_nvram_directory() The value of an arithmetic expression is subject of possible overflow due to a failure to cast operands to a larger data type before p... Read more
Affected Products : linux_kernel- Published: Oct. 07, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Memory Corruption
-
4.8
MEDIUMCVE-2025-43821
Cross-site scripting (XSS) vulnerability in the Commerce Product Comparison Table widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote attack... Read more
- Published: Oct. 08, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Cross-Site Scripting
-
4.8
MEDIUMCVE-2025-43829
Stored cross-site scripting (XSS) vulnerability in diagram type products in Commerce in Liferay Portal 7.4.3.18 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 18 through update 92 allows remote ... Read more
- Published: Oct. 08, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Cross-Site Scripting