23691 matches found
CVE-2025-38175
In the Linux kernel, the following vulnerability has been resolved: binder: fix yet another UAF in binderdevices Commit e77aff5528a18 "binderfs: fix use-after-free in binderdevices" addressed a use-after-free where devices could be released without first being removed from the binderdevices list...
CVE-2025-38175
The CVE-2025-38175 entry concerns a use-after-free in the Linux kernel binder subsystem (binder_devices) that could occur when a binder device is released without first being removed from the binder_devices list. The Astra Linux bulletin documents the root cause in binder_remove_device within bin...
CVE-2025-28969
creationtimestamp| type| source ---|---|--- 2025-07-04 10:10:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lt4yu2q4bi2i 2025-08-06 13:54:19+00:00| seen| MISP/1413a78e-c0b3-4092-97e7-909fb9773448 2025-08-14 11:44:21+00:00| seen| MISP/1413a78e-c0b3-4092-97e7-909fb9773448...
CVE-2025-28951
creationtimestamp| type| source ---|---|--- 2025-07-04 10:00:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lt4yc5rg332a...
CVE-2025-30979
creationtimestamp| type| source ---|---|--- 2025-07-04 09:50:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lt4xqaehx72r...
CVE-2025-24330
Sending a crafted SOAP "provision" operation message PlanId field within the Mobile Network Operator MNO internal Radio Access Network RAN management network can cause path traversal issue in Nokia Single RAN baseband software with versions earlier than release 24R1-SR 1.0 MP. This issue has been...
CVE-2025-28969
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in cybio Gallery Widget gallery-widget allows SQL Injection.This issue affects Gallery Widget: from n/a through = 1.2.1...
CVE-2025-53569 WordPress Trust Payments Gateway for WooCommerce (JavaScript Library) plugin <= 1.3.6 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery CSRF vulnerability in Trust Payments Trust Payments Gateway for WooCommerce JavaScript Library trust-payments-gateway-3ds2 allows Cross Site Request Forgery.This issue affects Trust Payments Gateway for WooCommerce JavaScript Library: from n/a through = 1.3.6...
CVE-2025-53600
Whale browser before 4.32.315.22 allow an attacker to bypass the Same-Origin Policy in a dual-tab environment...
CVE-2025-6238
creationtimestamp| type| source ---|---|--- 2025-07-04 03:50:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lt4dnazbp62u...
CVE-2025-38147
In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso functions for AFINET sk. syzkaller reported a null-ptr-deref in txoptget. 0 The offset 0x70 was of struct ipv6txoptions in struct ipv6pinfo, so struct ipv6pinfo was NULL there. However, this never...
CVE-2025-7046
CVE-2025-7046 : The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to a stored cross-site scripting (XSS) attack via the Custom JS Attributes of plugin widgets in all versions up to and including 3.2.0. Exploitation requires authenticated access at Contrib...
CVE-2025-5322
creationtimestamp| type| source ---|---|--- 2025-07-03 23:36:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lt3vgui7d62r...
CVE-2025-38095
In the Linux kernel, the following vulnerability has been resolved: dma-buf: insert memory barrier before updating numfences smpstoremb inserts memory barrier after storing operation. It is different with what the comment is originally aiming so Null pointer dereference can be happened if memory...
CVE-2025-49826
creationtimestamp| type| source ---|---|--- 2025-07-03 20:14:00+00:00| seen| https://bsky.app/profile/feedbot.unronritaro.net/post/3lt3k4dbpnz2z 2025-07-03 23:41:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lt3vptep5h2s 2025-07-04 00:06:22+00:00| seen|...
CVE-2025-52554 n8n Improper Authorization in Workflow Execution Stop Endpoint Allows Terminating Other Users’ Workflows
n8n is a workflow automation platform. Prior to version 1.99.1, an authorization vulnerability was discovered in the /rest/executions/:id/stop endpoint of n8n. An authenticated user can stop workflow executions that they do not own or that have not been shared with them, leading to potential...
BELL-CVE-2025-38099
Bulletin has no description...
CVE-2025-34087 Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution
An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain parameter is not properly sanitized, allowing an attacker to append OS commands to the domain string. These commands are executed on the...