6716 matches found
CVE-2025-38141
In the Linux kernel, the following vulnerability has been resolved: dm: fix dmblkreportzones If dmgetlivetable returned NULL, dmputlivetable was never called. Also, it is possible that md-zonerevalidatemap will change while calling this function. Only read it once, so that we are always using the...
CVE-2025-38167
The CVE-2025-38167 entry pertains to the Linux kernel, specifically the ntfs3 filesystem driver. Root cause: hdr_first_de() may return NULL, and error handling for this return value should be implemented consistently. The description notes that error handling already exists at other call sites. I...
CVE-2025-38158
CVE-2025-38158 affects the Linux kernel (hisi_acc_vfio_pci) and fixes an XQE/AEQE DMA address error observed after migration. The root cause is an incorrect address construction when reading hardware registers, causing wrong DMA addresses for EQE/AEQE and guest kernel‑mode encryption services to ...
CVE-2025-38141
In the Linux kernel, the following vulnerability has been resolved: dm: fix dmblkreportzones If dmgetlivetable returned NULL, dmputlivetable was never called. Also, it is possible that md-zonerevalidatemap will change while calling this function. Only read it once, so that we are always using the...
CVE-2025-38140
In the Linux kernel, the following vulnerability has been resolved: dm: limit swapping tables for devices with zone write plugs dmrevalidatezones only allowed new or previously unzoned devices to call blkrevalidatediskzones. If the device was already zoned, disk-nrzones would always equal...
CVE-2025-38137 PCI/pwrctrl: Cancel outstanding rescan work when unregistering
In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: Cancel outstanding rescan work when unregistering It's possible to trigger use-after-free here by: a forcing rescanworkfunc to take a long time and b utilizing a pwrctrl driver that may be unloaded for some reason...
CVE-2025-38126
CVE-2025-38126 affects the Linux kernel’s stmmac driver in timestamp configuration. The root cause is that clk_ptp_rate can become 0 (if clk_get_rate returns 0 and the driver does not override it), leading to a division by zero during PTP initialization. The issue is fixed by adding an explicit c...
CVE-2025-38106 io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()
In the Linux kernel, the following vulnerability has been resolved: iouring: fix use-after-free of sq-thread in iouringshowfdinfo syzbot reports: BUG: KASAN: slab-use-after-free in getrusage+0x1109/0x1a60 Read of size 8 at addr ffff88810de2d2c8 by task a.out/304 CPU: 0 UID: 0 PID: 304 Comm: a.out...
CVE-2025-53006
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, in both PostgreSQL and Redshift, apart from parameters like "socketfactory" and "socketfactoryarg", there are also "sslfactory" and "sslfactoryarg" with similar functionality. The difference li...
CVE-2025-38092 ksmbd: use list_first_entry_or_null for opinfo_get_list()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use listfirstentryornull for opinfogetlist The listfirstentry macro never returns NULL. If the list is empty then it returns an invalid pointer. Use listfirstentryornull to check if the list is empty...
CVE-2025-49588 Linkwarden Local File Inclusion Vulnerability
Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In version 2.10.2, the server accepts links of format file:///etc/passwd and doesn't do any validation before sending them to parsers and playwright, this can result in leak of other...
CVE-2025-52462
creationtimestamp| type| source ---|---|--- 2025-07-02 09:06:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lsxueftojw2r 2025-07-06 20:55:49+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3ltd5tu7zpk2u...
CVE-2025-49741 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
...
CVE-2025-53104
gluestack-ui is a library of copy-pasteable components & patterns crafted with Tailwind CSS NativeWind. Prior to commit e6b4271, a command injection vulnerability was discovered in the discussion-to-slack.yml GitHub Actions workflow. Untrusted discussion fields title, body, etc. were directly...
CVE-2025-6920 Ai-inference-server: authentication bypass via unprotected inference endpoint in api
A flaw was found in the authentication enforcement mechanism of a model inference API in ai-inference-server. All /v1/ endpoints are expected to enforce API key validation. However, the POST /invocations endpoint failed to do so, resulting in an authentication bypass. This vulnerability allows...
CVE-2025-6951
A vulnerability classified as problematic was found in SAFECAM X300 up to 20250611. This vulnerability affects unknown code of the component FTP Service. The manipulation leads to use of default credentials. Access to the local network is required for this attack to succeed. The exploit has been...
CVE-2024-49365 tiny-secp256k1 allows for verify() bypass when running in bundled environment
tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a malicious JSON-stringifyable message can be made passing on verify, when global Buffer is the buffer package. This affects only environments where require'buffer' is the NPM buffer package. Buffer.isBuffer check can b...
CVE-2025-6936
creationtimestamp| type| source ---|---|--- 2025-07-01 00:07:10+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19991 2025-07-01 00:30:06+00:00| seen| https://bsky.app/profile/potato.software/post/3lsugzj6nce2c 2025-07-01 04:20:20+00:00| seen|...
CVE-2025-6910
creationtimestamp| type| source ---|---|--- 2025-06-30 15:06:02+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19934 2025-06-30 17:36:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lstpw5ki5u2a...