Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a race condition between device unplugging and firmware event handling that could lead to reuse after releas...

Security Risks Introduced by Weak Authentication in Smart Home IoT Systems

Smart home IoT systems rely on authentication mechanisms to ensure that only authorized entities can control devices and access sensitive functionality. In practice, these mechanisms must balance security with usability, often favoring persistent connectivity and minimal user interaction. This...

PT-2025-53216

In the Linux kernel, the following vulnerability has been resolved: tracing/user events: Ensure write index cannot be negative The write index indicates which event the data is for and accesses a per-file array. The index is passed by user processes during write calls as the first 4 bytes. Ensure...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the possibility that RDMA bnxtre may process completion events even after destroying QPs, potentially leadin...

Linux Distros Unpatched Vulnerability : CVE-2025-68748

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/panthor: Fix UAF race between device unplug and FW event processing The function panthorfwunplug will free the FW memory sections. The problem is that there...

CVE-2025-68667

Conduit is a chat server powered by Matrix. A vulnerability that affects a number of Conduit-derived homeservers allows a remote, unauthenticated attacker to force the target server to cryptographically sign arbitrary membership events. Affected products include Conduit prior to version 0.10.10,...

CVE-2025-68667

Conduit-derived homeservers are vulnerable to a signed membership event forgery due to lack of origin validation on signing requests. Affected: Conduit <0.10.10; continuwuity <0.5.0; Grapevine ; tuwunel

CVE-2025-68667 Conduit-derived homeservers are affected by a Confused Deputy and Improper Input Validation issue

Conduit is a chat server powered by Matrix. A vulnerability that affects a number of Conduit-derived homeservers allows a remote, unauthenticated attacker to force the target server to cryptographically sign arbitrary membership events. Affected products include Conduit prior to version 0.10.10,...

CVE-2025-68667 Conduit-derived homeservers are affected by a Confused Deputy and Improper Input Validation issue

Conduit is a chat server powered by Matrix. A vulnerability that affects a number of Conduit-derived homeservers allows a remote, unauthenticated attacker to force the target server to cryptographically sign arbitrary membership events. Affected products include Conduit prior to version 0.10.10,...

CVE-2025-68667 Conduit-derived homeservers are affected by a Confused Deputy and Improper Input Validation issue

Conduit is a chat server powered by Matrix. A vulnerability that affects a number of Conduit-derived homeservers allows a remote, unauthenticated attacker to force the target server to cryptographically sign arbitrary membership events. Affected products include Conduit prior to version 0.10.10,...

CVE-2023-53982

creationtimestamp| type| source ---|---|--- 2025-12-23 20:45:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3maomjikrto2f 2025-12-23 21:31:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3maop4bgoai2g...

PT-2025-52860

Name of the Vulnerable Software and Affected Versions continuwuity versions prior to 0.5.0 Description A remote, unauthenticated attacker can force the target server to cryptographically sign arbitrary membership events. This occurs because the server does not validate the origin of a signing...

continuwuity 安全漏洞

continuwuity is a home server from continuwuity open source. A security vulnerability exists in versions prior to continuwuity 0.5.0 that stems from not verifying the origin of a signature request, which could result in the server cryptographically signing an arbitrary membership event...

WordPress Events Manager Plugin Information Disclosure Vulnerability

WordPress Events Manager Plugin is a full-featured open source plugin designed for managing events on WordPress sites. WordPress Events Manager Plugin suffers from an information disclosure vulnerability that stems from an under-restricted getlocation operation, which can be exploited by an...

CVE-2025-12976

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'eventslistgrouped' shortcode in all versions up to, and including, 7.2.2.1 due to insufficient input sanitization and output escaping on user supplied...

VulnCheck KEV: CVE-2023-6360

The 'My Calendar' WordPress Plugin, version 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route...

CVE-2025-12976

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'eventslistgrouped' shortcode in all versions up to, and including, 7.2.2.1 due to insufficient input sanitization and output escaping on user supplied...

WordPress Google Calendar Events plugin <= 3.5.9 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Doan Dinh Van in WordPress Plugin Google Calendar Events versions = 3.5.9...

EUVD-2025-204249

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'eventslistgrouped' shortcode in all versions up to, and including, 7.2.2.1 due to insufficient input sanitization and output escaping on user supplied...

CVE-2025-12976 Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'eventslistgrouped' shortcode in all versions up to, and including, 7.2.2.1 due to insufficient input sanitization and output escaping on user supplied...