23602 matches found
CVE-2025-22109
In the Linux kernel, the following vulnerability has been resolved: ax25: Remove broken autobind Binding AX25 socket by using the autobind feature leads to memory leaks in ax25connect and also refcount leaks in ax25release. Memory leak was detected with kmemleak:...
CVE-2025-3294 WP Editor <= 1.2.9.1 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Update
The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to overwrite arbitrary files on the affected...
CVE-2025-43715
Nullsoft Scriptable Install System NSIS before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition...
CVE-2025-32993
Vision Helpdesk through 5.7.0 allows Time-Based Blind SQL injection via the Forgot Password aka index.php?/home/forgot-password visusername parameter. Authentication is not needed...
CVE-2025-33027
In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of Bandizip. User interaction is required to exploit this vulnerability in that the target must vis...
CVE-2025-1290
A race condition Use-After-Free vulnerability exists in the virtiotransportspaceupdate function within the Kernel 5.4 on ChromeOS. Concurrent allocation and freeing of the virtiovsocksock structure during an AFVSOCK connect syscall can occur before a worker thread accesses it resulting in a...
CVE-2025-43708
creationtimestamp| type| source ---|---|--- 2025-04-17 00:59:47+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12177 2025-04-17 02:48:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmy3rxj5s52h 2025-04-17 04:37:07+00:00| seen|...
CVE-2024-55371
creationtimestamp| type| source ---|---|--- 2025-04-17 00:25:55+00:00| seen| https://t.me/cvedetector/23179 2025-04-17 14:49:03+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114353854322463749...
CVE-2025-1290
A race condition Use-After-Free vulnerability exists in the virtiotransportspaceupdate function within the Kernel 5.4 on ChromeOS. Concurrent allocation and freeing of the virtiovsocksock structure during an AFVSOCK connect syscall can occur before a worker thread accesses it resulting in a...
CVE-2025-1290
A race condition Use-After-Free vulnerability exists in the virtiotransportspaceupdate function within the Kernel 5.4 on ChromeOS. Concurrent allocation and freeing of the virtiovsocksock structure during an AFVSOCK connect syscall can occur before a worker thread accesses it resulting in a...
CVE-2025-29460
The CVE-2025-29460 entry concerns MyBB 1.8.38. The vulnerability affects the Add Mycode function, enabling a remote attacker to obtain sensitive information. Core product: MyBB (PHP/MySQL-based forum software). Root cause: mishandling of the Add Mycode feature, as described across multiple source...
CVE-2025-29044
Buffer Overflow vulnerability in Netgear- R61 router V1.0.1.28 allows a remote attacker to execute arbitrary code via the QUERYSTRING key value...
CVE-2025-29040
An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the targetaddr key value and the function 0x41737c...
CVE-2025-29451
An issue in Seo Panel 4.11.0 allows a remote attacker to obtain sensitive information via the Mail Setting component...
Amazon Linux 2 : pcs (ALAS-2025-2822)
The version of pcs installed on the remote host is prior to 0.9.169-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2822 advisory. Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type...
CVE-2025-29662
CVE-2025-29662 affects LandChat core application, version 3.25.12.18. The vulnerability is a remote code execution (RCE) issue that can be triggered by an unauthenticated attacker over the network to execute system code on the host. The core vulnerable component is the LandChat core application a...
CVE-2024-53924
Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IFA1=200, eval"import'os'.system substring...
CVE-2024-55211
CVE-2024-55211 affects Think Router Tk-Rt-Wr135G v3.0.2-X000. The issue is an authentication bypass via a crafted cookie in the router’s authentication flow, leading to potential exposure of sensitive areas. Root cause details are not fully disclosed in the provided documents, but the CVSS data i...
CVE-2025-29461
Affected software: a-blogcms 3.1.15. Vulnerability type: information disclosure via the path /bid/1/admin/entry-edit/. Root cause is not explicitly detailed in the provided documents, but multiple sources confirm the issue allows remote attackers to obtain sensitive information. Impact: confident...