CVE-2025-53701: Improper Neutralization of Input During Web Page Generation

Vilar VS-IPC1002 IP cameras are vulnerable to Reflected XSS Cross-site Scripting attacks, because parameters in GET requests sent to /cgi-bin/action endpoint are not sanitized properly, making it possible to target logged in admin users. The vendor did not respond in any way. Only version 1.1.0.1...

LLM Framework Cache Poisoning

The vulnerability of the getcachedir function in the framework for working with Large Language Models LLM like LlamaIndex is related to the creation of temporary files with insecure permissions. Exploiting this vulnerability could allow an attacker to execute a cache poisoning attack...

PT-2025-43493

Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description A flaw exists in the Framework component of Android operating systems due to insufficient input validation. Exploitation of this issue may allow an attacker to escalate privileges...

thunderbird: firefox: Use-after-free in MediaTrackGraphImpl::GetInstance()

A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in MediaTrackGraphImpl::GetInstance...

CVE-2022-50572

In the Linux kernel, the following vulnerability has been resolved: ASoC: audio-graph-card: fix refcount leak of cpuep in graphforeachlink The ofgetnextchild returns a node with refcount incremented, and decrements the refcount of prev. So in the error path of the while loop, ofnodeput needs be...

CVE-2022-50562

In the Linux kernel, the following vulnerability has been resolved: tpm: acpi: Call acpiputtable to fix memory leak The start and length of the event log area are obtained from TPM2 or TCPA table, so we call acpigettable to get the ACPI information, but the acpigettable should be coupled with...

CVE-2022-50572 ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link()

In the Linux kernel, the following vulnerability has been resolved: ASoC: audio-graph-card: fix refcount leak of cpuep in graphforeachlink The ofgetnextchild returns a node with refcount incremented, and decrements the refcount of prev. So in the error path of the while loop, ofnodeput needs be...

CVE-2022-50562

CVE-2022-50562 : In the Linux kernel, the TPM ACPI path leaked memory because acpi_get_table() was not paired with acpi_put_table(). The fix adds acpi_put_table() to release ACPI memory and also removes a redundant empty line in tpm_read_log_acpi(). This resolves a memory leak in the TPM2/TCPA ev...

PT-2026-2552

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's ext4 implementation related to extended attribute handling. Specifically, a null pointer dereference can occur within the ext4 raw inode function if...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a resource leak in the mt7915ratetxpowerget function...

Moderate: java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fixes: JDK: Enhance Path Factories CVE-2025-53066 JDK: Enhance Certificate Handling CVE-2025-53057 Bug Fixes: Since the 8.8 release of AlmaLinuxand the 9.2...

CVE-2025-62597

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1, a reflected cross-site scripting XSS vulnerability was identified in the editarinfopessoal.php endpoint of the WeGIA application. This vulnerability allows attackers to inject...

EUVD-2025-35216

The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Change via crafted POST request to /getset.ccp...

CVE-2025-52079

The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Change via crafted POST request to /getset.ccp...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987700)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987700 advisory. In the Linux kernel, the following vulnerability has been resolved: rtc: mt6397: check return value after calling platformgetresource It will cause null-ptr-deref if...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987516)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987516 advisory. In the Linux kernel, the following vulnerability has been resolved: tpm: use trygetops in tpm-space.c As part of the series conversion to remove nested TPM operation...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987608)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987608 advisory. In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: out of bounds read in mtkhwlrogetfdirentry The fsp-location variable...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987592)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987592 advisory. In the Linux kernel, the following vulnerability has been resolved: USB: host: isp116x: check return value after calling platformgetresource It will cause...

thunderbird: firefox: Use-after-free in MediaTrackGraphImpl::GetInstance()

A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in MediaTrackGraphImpl::GetInstance...

EUVD-2025-35068

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix warning in smcrxsplice when calling getpage smcloregisterdmb allocates DMB buffers with kzalloc, which are later passed to getpage in smcrxsplice. Since kmalloc memory is not page-backed, this triggers WARNONONCE in...