CVE-2025-38724 nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()

In the Linux kernel, the following vulnerability has been resolved: nfsd: handle getclientlocked failure in nfsd4setclientidconfirm Lei Lu recently reported that nfsd4setclientidconfirm did not check the return value from getclientlocked. a SETCLIENTIDCONFIRM could race with a confirmed client...

CVE-2025-38724

CVE-2025-38724: Linux kernel NFS server (nfsd) had a race in nfsd4_setclientid_confirm() where it did not check get_client_locked() return, risking reference loss and a potential use-after-free. A fix obtains a reference early when a confirmed client exists, and handles failure as if no confirmed...

PT-2025-92: Local Privilege Escalation in IDrive

The vulnerability was identified in IDrive, version 4.0.0.38. The discovered vulnerability allows an attacker to escalate privileges from a normal user to root. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 02.09.2025 Recommendations: Update to version MacVersion...

CVE-2025-50983

Readarr 0.4.15.2787 exposes a SQL Injection in the sortKey parameter of GET /api/v1/wanted/cutoff. The endpoint fails to sanitize user input, enabling arbitrary SQL execution against the backend SQLite DB. Exploitation was confirmed with sqlmap via stacked queries; a heavy query using SQLite RAND...

CVE-2023-1893

creationtimestamp| type| source ---|---|--- 2025-08-19 11:41:12+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2023/CVE-2023-1893.yaml 2025-08-23 21:02:24+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lx3ulqp22b2z...

CVE-2020-36708

creationtimestamp| type| source ---|---|--- 2025-08-19 03:00:06+00:00| seen| Telegram/-Fva4EPYFaBqns2Cr0zCt3lPp7sYwzJV4LoxTKWmPvbqvA 2025-08-19 05:58:57+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2020/CVE-2020-36708.yaml 2025-08-21 21:02:32+00:00|...

MAL-2025-8365 Malicious code in @lbnqduy1/upgraded-carnival (npm)

The package @lbnqduy1/upgraded-carnival was found to contain malicious code...

PT-2025-66: Arbitrary file write in Booco

The vulnerability was identified in Booco, version Server v2.38.3. The discovered vulnerability allows an attacker to supply a relative path in a parameter, which results in a new file being created or an existing file being overwritten in any directory of the file system. Vulnerability status:...

PT-2025-108: Insufficient authorization in FreeScout

The vulnerability was identified in FreeScout, version 1.8.182. The discovered vulnerability allows an attacker to subvert access‑control verification in the Kanban module, obtaining unauthorized access to protected functionality. Vulnerability status: Confirmed by vendor Date of vulnerability...

PT-2025-111: Insufficient authorization in FreeScout

The vulnerability was identified in FreeScout, version 1.8.182. The discovered vulnerability allows an attacker to exploit incorrect authorization, obtaining information or functions beyond their privileges. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 08.08.2025...

PT-2025-109: Insufficient authorization in FreeScout

The vulnerability was identified in FreeScout , versions 1.8.182. The discovered vulnerability allows an attacker to bypass access‑control in the Custom Fields module, performing actions not permitted for their role. Vulnerability status: Confirmed by vendor Date of vulnerability remediation:...

PT-2025-102: Deserialization of untrusted data in FreeScout

The vulnerability was identified in FreeScout, version 1.8.182. The discovered vulnerability allows an attacker to deserialize unsafe data, gain control over application objects and impair its operation. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 19.07.2025...

PT-2025-103: Deserialization of untrusted data in FreeScout

The vulnerability was identified in FreeScout, version 1.8.182. The discovered vulnerability allows an attacker to deserialize data, instantiate arbitrary objects and alter their properties, causing severe disruption of the system. Vulnerability status: Confirmed by vendor Date of vulnerability...

CVE-2024-33832

creationtimestamp| type| source ---|---|--- 2025-07-17 11:51:46+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-33832.yaml 2025-07-18 21:02:27+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lubdsqw3eh2q...

CVE-2024-36675

creationtimestamp| type| source ---|---|--- 2025-07-17 11:50:29+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-36675.yaml 2025-07-18 21:02:28+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lubdsqyf772p 2025-08-12...

PT-2025-31069

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A crash in the conntrack component of the Linux kernel was reported due to the removal of an uninitialized entry. The issue occurs when an expired conntrack entry is deleted from the has...

CVE-2025-27505

creationtimestamp| type| source ---|---|--- 2025-07-10 20:15:34+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-27505.yaml 2025-07-14 21:02:22+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3ltxbwwatkv2p 2025-07-24...

CVE-2025-6970

creationtimestamp| type| source ---|---|--- 2025-07-10 03:00:13+00:00| published-proof-of-concept| Telegram/VL2zkodKXJ4s7-qnqkcGB4g3iOsCKYXSgneWGoW9UEmWyHE 2025-07-15 16:23:39+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-6970.yaml...

CVE-2025-4380

creationtimestamp| type| source ---|---|--- 2025-07-09 05:00:00+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-4380.yaml 2025-07-09 21:02:24+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3ltkpmbglm423 2025-08-06...

PT-2025-67: XML external entity leads to Local File Read and Server-side request forgery in FastReport.NET

The vulnerability was identified in FastReport .NET, versions 2024.2.20. The discovered vulnerability, due to the ability to inject and expand external entities, can be exploited by an attacker to read arbitrary local files and perform server‑side request forgery SSRF with full response retrieval...