CVE-2025-13457

The WooCommerce Square plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.1 via the gettokenbyid function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary Squa...

CVE-2025-64092

This vulnerability allows unauthenticated attackers to inject an SQL request into GET request parameters and directly query the underlying database...

CVE-2025-10865 GPU DDK - DevmemIntGetReservationData does not ref the PMR it returns

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of reference counting to cause a potential use after free. Improper reference counting on an internal resource caused scenario where potential for use after free was present...

CVE-2025-68820

In the Linux kernel, the following vulnerability has been resolved: ext4: xattr: fix null pointer deref in ext4rawinode If ext4getinodeloc fails e.g. if it returns -EFSCORRUPTED, iloc.bh will remain set to NULL. Since ext4xattrinodedecrefall lacks error checking, this will lead to a null pointer...

CVE-2025-68820

In the Linux kernel, the following vulnerability has been resolved: ext4: xattr: fix null pointer deref in ext4rawinode If ext4getinodeloc fails e.g. if it returns -EFSCORRUPTED, iloc.bh will remain set to NULL. Since ext4xattrinodedecrefall lacks error checking, this will lead to a null pointer...

AZL-74445 CVE-2025-68774 affecting package kernel for versions less than 6.6.121.1-1

In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix missing hfsbnodeget in hfsbnodecreate When sync and link are called concurrently, both threads may enter hfsbnodefind without finding the node in the hash table and proceed to create it. Thread A: hfspluswriteinode -...

CVE-2025-68769

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix return value of f2fsrecoverfsyncdata With below scripts, it will trigger panic in f2fs: mkfs.f2fs -f /dev/vdd mount /dev/vdd /mnt/f2fs touch /mnt/f2fs/foo sync echo 111 /mnt/f2fs/foo f2fsio fsync /mnt/f2fs/foo f2fsio...

CVE-2025-68795

CVE-2025-68795 (Linux kernel) is mitigated by a patch that prevents buffer overflow during ethtool stats queries. When the number of stats changes between ETHTOOL_GSSET_INFO, ETHTOOL_GSTRINGS, and ETHTOOL_GSTATS, ethtool_get_strings(), ethtool_get_stats(), and ethtool_get_phy_stats() now return n...

CVE-2025-68795

In the Linux kernel, the following vulnerability has been resolved: ethtool: Avoid overflowing userspace buffer on stats query The ethtool -S command operates across three ioctl calls: ETHTOOLGSSETINFO for the size, ETHTOOLGSTRINGS for the names, and ETHTOOLGSTATS for the values. If the number of...

CVE-2025-68774

CVE-2025-68774 is a race in the Linux kernel’s hfsplus code where concurrent sync() and link() can create the same bnode, both threads end with refcnt=1 due to missing hfs_bnode_get(). When the second thread reuses the node from the hash, a BUG_ON triggers on refcnt. The fix is to call hfs_bnode_...

CVE-2025-68774 hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create

In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix missing hfsbnodeget in hfsbnodecreate When sync and link are called concurrently, both threads may enter hfsbnodefind without finding the node in the hash table and proceed to create it. Thread A: hfspluswriteinode -...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: f2fs: Fix to avoid a panic when fallocation fails for pinfile. The syzbot reports a f2fs bug as follows: ------------ Cut here ------------ Kernel BUG: At fs/f2fs/segment.c:2746! CPU: 0; UID: 0; PID: 5323; Comm: syz.0.0; Not...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: net/smc: fixed a warning in smcrxsplice, when calling getpage The smcloregisterdmb function allocates DMB buffers using kzalloc, which are later passed to getpage in smcrxsplice. Since kmalloc memory is not page-backed, this...

Astra Linux – Vulnerability in binutils

A vulnerability was identified in GNU Binutils 2.45. The function getlinkhashentry in the bfd/elflink.c file of the Linker component is affected by this vulnerability. This manipulation causes an out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: In the bpf module, it was necessary to check whether the helper function is valid in gethelperproto. The kernel test robot reported a bug related to the verifier 1, where the helper function pointer could be NULL due to a disable...

SUSE CVE-2026-21884

React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript...

MiracleLinux 7 : libxslt-1.1.28-6.0.3.el7.AXS7 (AXSA:2025-9905:06)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-9905:06 advisory. CVE-2024-55549: fix use-after-free issue related to exclusion of result prefixes CVEs: CVE-2024-55549 xsltGetInheritedNsList in libxslt before 1.1.43 has a...

PT-2026-38939

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel within the rockchip RGA component. The rga get frame function may return an ERR PTR-EINVAL when a buffer type is invalid or unsupported. Because the rga...

YouPHPTube path traversal vulnerability

YouPHPTube is YouPHPTube open source a PHP-based video website system . YouPHPTube 7.8 and earlier versions of the path traversal vulnerability , the vulnerability stems from improper manipulation of the lang parameter in the GET request , which could lead to local file containment...

CVE-2026-22800

PILOS (Platform for Interactive Live-Online Seminars) before version 4.10.0 contains a CSRF vulnerability in an administrative GET endpoint that terminates all active video conferences on a single BigBlueButton server. Although authorization checks exist, the use of GET allows implicit invocation...