WordPress Ultimate Member plugin <= 2.10.1 - Unauthenticated Blind SQL Injection vulnerability

Unauthenticated Blind SQL Injection vulnerability discovered by Muhamad Visat in WordPress Plugin Ultimate Member versions = 2.10.1...

PT-2025-17128 · WordPress · Tableon – Wordpress Posts Table Filterable

Name of the Vulnerable Software and Affected Versions: TableOn – WordPress Posts Table Filterable versions 1.0.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks...

Dell ECS input validation error vulnerability

Dell ECS is an enterprise-class object storage solution from Dell Technologies. Dell ECS suffers from an input validation error vulnerability that stems from the system failing to properly process specific inputs. No details of the vulnerability are provided at this time...

PT-2025-17132 · Wooms · Wooms

Name of the Vulnerable Software and Affected Versions: aiiddqd WooMS versions through 9.12 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This means an attacker can inject maliciou...

CVE-2025-2400

creationtimestamp| type| source ---|---|--- 2025-04-16 22:57:45+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/12166 2025-04-17 02:48:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmy3ry5xko24...

CVE-2025-32783

creationtimestamp| type| source ---|---|--- 2025-04-16 22:44:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmxo5clxcv2q 2025-04-17 02:06:43+00:00| seen| https://t.me/cvedetector/23205...

CVE-2025-29708

creationtimestamp| type| source ---|---|--- 2025-04-16 22:43:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmxo3kyh252u 2025-04-17 00:25:47+00:00| seen| https://t.me/cvedetector/23172 2025-04-17 13:57:47+00:00| published-proof-of-concept|...

CVE-2025-29648

creationtimestamp| type| source ---|---|--- 2025-04-16 19:56:35+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12147 2025-04-17 00:26:02+00:00| seen| https://t.me/cvedetector/23185 2025-04-17 16:34:28+00:00| seen|...

CVE-2025-32860

creationtimestamp| type| source ---|---|--- 2025-04-16 18:44:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmxapuk6h52l 2025-04-16 20:48:35+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114349605735183980 2025-04-16 21:55:05+00:00| seen|...

CVE-2025-2564 Unauthorized View Access to Archived Channel Member Info

Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to properly enforce the 'Allow users to view/update archived channels' System Console setting, which allows authenticated users to view members and member information of archived channels even when this setting is disabled...

CVE-2025-22092

In the Linux kernel, the following vulnerability has been resolved: PCI: Fix NULL dereference in SR-IOV VF creation error path Clean up when virtfn setup fails to prevent NULL pointer dereference during device removal. The kernel oops below occurred due to incorrect error handling flow when...

CVE-2025-22105

In the Linux kernel, the following vulnerability has been resolved: bonding: check xdp prog when set bond mode Following operations can trigger a warning1: ip netns add ns1 ip netns exec ns1 ip link add bond0 type bond mode balance-rr ip netns exec ns1 ip link set dev bond0 xdp obj afxdpkern.o se...

CVE-2025-22128

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Clear affinity hint before calling ath12kpcifreeirq in error path If a shared IRQ is used by the driver due to platform limitation, then the IRQ affinity hint is set right after the allocation of IRQ vectors in...

CVE-2025-22096

In the Linux kernel, the following vulnerability has been resolved: drm/msm/gem: Fix error code msmparsedeps The SUBMITERROR macro turns the error code negative. This extra '-' operation turns it back to positive EINVAL again. The error code is passed to ERRPTR and since positive values are not a...

CVE-2025-22112

In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix out-of-range access of vnicinfo array The bnxtqueuestart | stop access vnicinfo as much as allocated, which indicates bp-nrvnics. So, it should not reach bp-vnicinfobp-nrvnics...

CVE-2025-22062

In the Linux kernel, the following vulnerability has been resolved: sctp: add mutual exclusion in procsctpdoudpport We must serialize calls to sctpudpsockstop and sctpudpsockstart or risk a crash as syzbot reported: Oops: general protection fault, probably for non-canonical address...

CVE-2025-22028

In the Linux kernel, the following vulnerability has been resolved: media: vimc: skip .sstream for stopped entities Syzbot reported 1 a warning prompted by a check in callsstream that checks whether .sstream operation is warranted for unstarted or stopped subdevs. Add a simple fix in...

CVE-2025-22035

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in printgraphfunctionflags during tracer switching Kairui reported a UAF issue in printgraphfunctionflags during ftrace stress testing 1. This issue can be reproduced if puting a 'mdelay10' after...

CVE-2025-39599

creationtimestamp| type| source ---|---|--- 2025-04-16 14:43:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmwtcbmbqj2q 2025-04-16 16:02:49+00:00| seen| https://t.me/cvedetector/23093...

CVE-2025-22036 exfat: fix random stack corruption after get_block

In the Linux kernel, the following vulnerability has been resolved: exfat: fix random stack corruption after getblock When getblock is called with a bufferhead allocated on the stack, such as dompagereadpage, stack corruption due to bufferhead UAF may occur in the following race condition...