The vulnerability of the wilc_wlan_init() function in the drivers/net/wireless/microchip/wilc1000/wlan.c file of the Microchip driver module allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information in Linux operating system-based devices.

The vulnerability of the wilcwlaninit function in the drivers/net/wireless/microchip/wilc1000/wlan.c file of the Microchip Linux kernel driver for wireless adapter support is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to compromise the...

CVE-2025-2615

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that could have allowed a blocked user to access sensitive information by establishing GraphQL subscriptions through WebSocket connections...

Microsoft Excel Information Leakage Vulnerability (CNVD-2026-00026)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. An information leakage vulnerability exists in Microsoft Excel, which is caused due to improper authorization validation. An attacker could exploit the vulnerability to obtain sensitive information...

CVE-2022-4984

ZenTao Biz 6.5, ZenTao Max 3.0, ZenTao Open Source Edition 16.5, and ZenTao Open Source Edition 16.5.beta1 contain an SQL injection vulnerability in the login functionality. The application does not properly validate the account parameter on /zentao/user-login.html before using it in a database...

CVE-2025-11777

Mattermost versions 10.11.x = 10.11.3, 10.5.x = 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint...

WordPress plugin Survey Maker 安全漏洞

WordPress Survey Maker plugin is a tool for creating questionnaires with support for multiple question types and data analysis features for businesses or individuals to collect user feedback. An unauthorized access vulnerability exists in the WordPress Survey Maker plugin, which stems from a lack...

编号撤回

ViewLead Bacteriology Laboratory Reporting System is a Bacteriology Laboratory Reporting System from China-based ViewLead. The ViewLead Bacteriology Laboratory Reporting System suffers from a SQL injection vulnerability that originates from SQL injection and could allow an unauthenticated, remote...

The vulnerability of the WebXR components in Google Chrome and Microsoft Edge allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the WebXR components in Google Chrome and Microsoft Edge relates to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

QNAP File Station 5 Cross-Site Scripting Vulnerability

QNAP File Station 5 is a core file management application developed by Qualcomm Technologies QNAP for its networked storage NAS devices. QNAP File Station 5 suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplie...

EulerOS 2.0 SP12 : glib2 (EulerOS-SA-2025-2355)

According to the versions of the glib2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to...

Vulnerabilities fixed in Microsoft Windows

Microsoft has fixed vulnerabilities in Windows. A malicious party can exploit the vulnerabilities to carry out attacks that can lead to the following categories of damage: - Denial-of-Service - Execution of arbitrary code root/admin privileges - Accessing sensitive data - Obtaining elevated...

Vulnerabilities fixed in Siemens products

Siemens has fixed vulnerabilities in several products such as Altair Grid Engine, COMOS, LOGO, SICAM, SIDOOR, SIMATIC, SIPLUS, Spectrum Power and Solid Edge. The vulnerabilities potentially enable a malicious person to carry out attacks that can lead to the following categories of damage: -...

CVE-2025-12865

U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2025-42885

Due to missing authentication, SAP HANA 2.0 hdbrss allows an unauthenticated attacker to call a remote-enabled function that will enable them to view information. As a result, it has a low impact on the confidentiality but no impact on the integrity and availability of the system...

CVE-2025-42897

CVE-2025-42897 describes an information disclosure vulnerability in the anonymous API of SAP Business One Service Layer Directory (SLD). An attacker with normal user access could obtain unauthorized information, resulting in low confidentiality impact and no impact on integrity or availability. A...

SAP Business Connector 跨站脚本漏洞

SAP Business Connector is a middleware from SAP, Germany. A cross-site scripting vulnerability exists in SAP Business Connector due to improper validation of user-supplied input in the PRTG Web Monitor web interface. An attacker could exploit the vulnerability to access or modify information with...

Microsoft Dynamics 365 信息泄露漏洞

Microsoft Dynamics 365 is a suite of ERP business solutions for multinational organizations from Microsoft USA. It is used for financial management, production management and business intelligence management. An information disclosure vulnerability exists in Microsoft Dynamics 365. An attacker...

The vulnerability of the embedded web-server microprogramming software for load controllers ABB ALS-mini-s4 IP and ALS-mini-s8 IP allows a hacker to circumvent security restrictions and gain unauthorized access to read and modify data.

The vulnerability of the embedded web-server microprogramming software for load controllers ABB ALS-mini-s4 IP and ALS-mini-s8 IP is related to the absence of authentication for a critical function. Exploiting this vulnerability could allow an attacker to bypass security restrictions and gain...

The vulnerability of the SuiteCRM customer relationship management system, related to deficiencies in the authentication process, allows a perpetrator to gain access to read and modify data.

The vulnerability of the SuiteCRM customer relationship management system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain read and edit access to data...

SUSE SLES15: java-1_8_0-openjdk / java-1_8_0-openjdk-accessibility / etc (SUSE-SU-2025:4039-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4039-1 advisory. Update to version jdk8u472 icedtea-3.37.0: - CVE-2025-53057: Fixed certificate handling leading to unauthorized...