CVE-2025-8971

CVE-2025-8971 SQL Injection Author: Byte Reaper Description : This exploit for CVE-2025-8971, a SQL injection vulnerability in itsourcecode Online Tour and Travel Management System 1.0. The vulnerability exists in /admin/operations/travellers.php and can be exploited remotely via the val-username...

WordPress Automated Import Products to Cart plugin < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion vulnerability

Subscriber+ Arbitrary File Read and Deletion vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Automated Import Products to Cart versions 1.0.4...

WordPress Chat AI with Dispatcher plugin < 2.4 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Chat AI with Dispatcher versions 2.4...

Malicious code in spectral-net-probe (npm)

spectral-net-probe has no functional code. Versions 1.0.1 and 1.0.4 have a postinstall script that runs node index.js on npm install, which sends an HTTPS GET to a Cloudflare quick tunnel https://nobody-johnston-with-enabling.trycloudflare.com/aa?x=1 and...

OESA-2026-4620 patch security update

Patch takes a patch file containing a difference listing produced by the diff program and applies those differences to one or more original files, producing patched versions. Security Fixes: A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended workin...

OESA-2026-4619 patch security update

Patch takes a patch file containing a difference listing produced by the diff program and applies those differences to one or more original files, producing patched versions. Security Fixes: A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended workin...

OESA-2026-4618 patch security update

Patch takes a patch file containing a difference listing produced by the diff program and applies those differences to one or more original files, producing patched versions. Security Fixes: A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended workin...

OESA-2026-4617 patch security update

Patch takes a patch file containing a difference listing produced by the diff program and applies those differences to one or more original files, producing patched versions. Security Fixes: A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended workin...

OESA-2026-4596 mariadb security update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon mariadbd and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs a...

OESA-2026-4595 mariadb security update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon mariadbd and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs a...

OESA-2026-4587 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allo...

OESA-2026-4585 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allo...

OESA-2026-4586 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allo...

OESA-2026-4584 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allo...

OESA-2026-4570 flatpak security update

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information. Security Fixes: In Flatpak before 1.18.1, a malicious sandboxed app can replace /.var/app/$appid/.ld.so with a symlink, causi...

OESA-2026-4559 python-aiohttp security update

Async http client/server framework asyncio. Security Fixes: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with a...

OESA-2026-4560 python-aiohttp security update

Async http client/server framework asyncio. Security Fixes: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with a...

OESA-2026-4558 python-aiohttp security update

Async http client/server framework asyncio. Security Fixes: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with a...

CVE-2026-99111

A flaw was found in the Linux kernel's Server Message Block SMB client. Inadequate locking during file truncation allows a local user to perform concurrent write operations while a file is being truncated. This race condition causes newly written data to be discarded silently, resulting in data...

CVE-2026-99102

A flaw was found in the Linux kernel's NTFS file system. The file resize operation fails to acquire the proper synchronization lock while updating on-disk file attributes and sizes. A local user can exploit this race condition by accessing memory-mapped files during a resize operation, causing...