CVE-2025-22115 btrfs: fix block group refcount race in btrfs_create_pending_block_groups()

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix block group refcount race in btrfscreatependingblockgroups Block group creation is done in two phases, which results in a slightly unintuitive property: a block group can be allocated/deallocated from after...

CVE-2025-22106 vmxnet3: unregister xdp rxq info in the reset path

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: unregister xdp rxq info in the reset path vmxnet3 does not unregister xdp rxq info in the vmxnet3resetwork code path as vmxnet3rqdestroy is not invoked in this code path. So, we get below message with a backtrace. Missin...

CVE-2025-22065 idpf: fix adapter NULL pointer dereference on reboot

In the Linux kernel, the following vulnerability has been resolved: idpf: fix adapter NULL pointer dereference on reboot With SRIOV enabled, idpf ends up calling into idpfremove twice. First via idpfshutdown and then again when idpfremove calls into sriovdisable, because the VF devices use the id...

Symfonia Ready_ SQL注入漏洞

Symfonia Ready is an operating system from Symfonia that builds programs for companies to use off-the-shelf modules and business applications. Symfonia Ready has an SQL injection vulnerability that stems from improper input cleanup in the Invoices module file search function, which could lead to ...

Symfonia Ready_ 跨站脚本漏洞

Symfonia Ready is an operating system from Symfonia that builds programs for companies to use off-the-shelf modules and business applications. A cross-site scripting vulnerability exists in Symfonia Ready, which stems from insufficient input cleanup in the File Explorer upload function and could...

WordPress plugin Form Maker by 10Web 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

PT-2025-16746

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, specifically in the vmxnet3 component. The issue arises because vmxnet3 does not unregister XDP RXQ info in the reset path, leading...

WordPress plugin Checkout Files Upload for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress plugin BMA Lite SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

Hitachi Vantara Pentaho Business Analytics Server 安全漏洞

Hitachi Vantara Pentaho Business Analytics Server is a modern data blending, integration, and business analytics platform from Hitachi, Ltd Hitachi, Japan. A security vulnerability exists in Hitachi Vantara Pentaho Business Analytics Server versions prior to 10.2.0.2, 9.3.x, and 8.3.x. The...

PT-2025-38567

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free vulnerability exists in the Bluetooth stack, specifically within the l2cap sock cleanup listen function. The issue arises from a race condition where a socket can be fre...

CVE-2025-32439 pleezer allows resource exhaustion through uncollected hook script processes

pleezer is a headless Deezer Connect player. Hook scripts in pleezer can be triggered by various events like track changes and playback state changes. In versions before 0.16.0, these scripts were spawned without proper process cleanup, leaving zombie processes in the system's process table. Even...

CVE-2025-32439 pleezer allows resource exhaustion through uncollected hook script processes

pleezer is a headless Deezer Connect player. Hook scripts in pleezer can be triggered by various events like track changes and playback state changes. In versions before 0.16.0, these scripts were spawned without proper process cleanup, leaving zombie processes in the system's process table. Even...

The vulnerability of microprogrammed routing devices with integrated networking services from Cisco ISR 800 and Cisco ISR 1900, microprogrammed access points from Cisco Aironet Access Points (AP) models 1530, 1552, 1570, 1700, 2700, 3700, and microprogrammed wireless industrial access points from Cisco Industrial Wireless 3700, is related to incomplete resource cleanup. This vulnerability allows a malicious actor to trigger service failures.

The vulnerability of microprogrammed routing devices with integrated networking services from Cisco ISR 800 and Cisco ISR 1900, microprogrammed access points from Cisco Aironet models 1530, 1552, 1570, 1700, 2700, 3700, and microprogrammed wireless industrial access points from Cisco Industrial...

Growatt Cloud Applications 跨站脚本漏洞

Growatt Cloud Applications is a monitoring platform from China-based Growatt. A cross-site scripting vulnerability exists in Growatt Cloud Applications 3.6.0 and prior versions, which stems from improper cleanup of plant name values when adding or editing plants, and could lead to stored cross-si...

RHEL 7 : openstack-neutron (RHSA-2014:1942)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:1942 advisory. OpenStack Networking neutron is a pluggable, scalable, and API-driven system that provisions networking services to virtual machines. Its main functi...

WordPress plugin Tourmaster 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

GHSA-472W-7W45-G3W5 Pleezer resource exhaustion through uncollected hook script processes

Impact Hook scripts in pleezer can be triggered by various events like track changes and playback state changes. In affected versions, these scripts were spawned without proper process cleanup, leaving zombie processes in the system's process table. Even during normal usage, every track change an...

Pleezer resource exhaustion through uncollected hook script processes

Impact Hook scripts in pleezer can be triggered by various events like track changes and playback state changes. In affected versions, these scripts were spawned without proper process cleanup, leaving zombie processes in the system's process table. Even during normal usage, every track change an...

Eclipse ThreadX NetX Duo HTTP server denial of service vulnerability

Talos Vulnerability Report TALOS-2024-2098 Eclipse ThreadX NetX Duo HTTP server denial of service vulnerability April 14, 2025 CVE Number CVE-2025-2260,None SUMMARY A denial of service vulnerability exists in the NetX HTTP server functionality of Eclipse ThreadX NetX Duo git commit 6c8e9d1. A...