CVE-2025-38252

The CVE-2025-38252 entry concerns a Linux kernel vulnerability in the cxl/ras CPER handler device confusion. The defect stems from cxl_cper_handle_prot_err() making fragile assumptions: it may treat endpoints as CXL-Type-3 devices, assume the device is bound to the cxl_pci driver, and unnecessari...

SUSE SLED15: libopenssl-3-devel / libopenssl-3-fips-provider / etc (SUSE-SU-2025:02236-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02236-1 advisory. - CVE-2025-27587: Fixed Minerva side channel vulnerability in P-384 bsc1240366. - Backport mdless cms signing support...

Microsoft Visual Studio 后置链接漏洞

Microsoft Visual Studio is a family of development tool suites and a largely complete development toolset from Microsoft Corporation USA that includes most of the tools needed throughout the software lifecycle. A backlink vulnerability exists in Microsoft Visual Studio. The following products and...

AZL-65394 CVE-2024-25176 affecting package sysbench for versions less than 1.0.20-3

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in ljstrfmtwfnum in ljstrfmtnum.c...

AZL-64809 CVE-2025-48367 affecting package redis for versions less than 6.2.18-3

Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause repeated IP protocol errors, leading to client starvation and, ultimately, a denial of service. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19...

TencentOS Server 3: container-tools:rhel8 (TSSA-2025:0497)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0497 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

TencentOS Server 3: sudo (TSSA-2025:0514)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0514 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

TencentOS Server 3: libxslt (TSSA-2025:0489)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0489 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

TencentOS Server 3: git-lfs (TSSA-2025:0493)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0493 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

TencentOS Server 3: pam (TSSA-2025:0519)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0519 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

AZL-64650 CVE-2025-5372 affecting package libssh for versions less than 0.10.6-2

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the sshkdf function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenl...

WordPress Radio Station plugin <= 2.5.12 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Ngoc Quang Bach maysbachs in WordPress Plugin Radio Station versions = 2.5.12...

CVE-2025-3702

creationtimestamp| type| source ---|---|--- 2025-07-03 15:15:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lt2zfy7fdv2m...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload via the fileUploadHandler process. An attacker can write arbitrary files to the filesystem by supplying crafted values to the fc.Name parameter, which is not properly sanitized, allowing directory traversal. This c...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload via the fileUploadHandler process. An attacker can write arbitrary files to the filesystem by supplying crafted values to the fc.Name parameter, which is not properly sanitized, allowing directory traversal. This c...

Bootstrap < 4.0.0 Multiples Cross-Site Scripting

According to its self-reported version number, Bootstrap is prior to 4.0.0. Therefore, it may be affected by Multiples Cross-Site Scripting XSS vulnerability : - A Cross-Site Scripting XSS vulnerability has been identified within the Bootstrap 3 Button component. - A Cross-Site Scripting XSS...

Alibaba Cloud Linux 3 : 0094: libvpx (ALINUX3-SA-2025:0094)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0094 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-5283: Use after free in libvpx in Google...

GLSA-202506-05 : GTK+ 3: Search path vulnerability

The remote host is affected by the vulnerability described in GLSA-202506-05 GTK+ 3: Search path vulnerability A vulnerability has been discovered in GTK+ 3. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block directly from the...

CVE-2025-53021

A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the...

CVE-2025-32878

An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WLAN. This function is mainly for downloading firmware files. Before downloading firmware files, the watch requests some information about the firmware via HTTPS from the back-end...