ERPNext get_rfq_containing_supplier function SQL Injection Vulnerability

ERPNext is an open source enterprise resource planning solution from ERPNext India. ERPNext suffers from a SQL injection vulnerability that stems from the lack of validation of the txt parameter of the getrfqcontainingsupplier function against externally entered SQL statements. An attacker can...

nvme-fc Component DoS

The vulnerability of the nvme-fc component of the Linux operating system’s kernel is related to the assignment of a null pointer in the function nvmefciogetuuid within the file drivers/nvme/host/fc.c. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2025-44389

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to the handling of Distributed File System DFS referrals within the SMB protocol. A malicious SMB server can send crafted responses to FSCTL DFS...

EUVD-2025-34263

A Cross-Site Request Forgery CSRF in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary operations via a crafted GET request...

Astra Linux - уязвимость в linux-5.10

In the Linux kernel, the following vulnerability has been resolved: Revert "riscv: Define TASKSIZEMAX for accessok" This reverts commit ad5643cf2f69 "riscv: Define TASKSIZEMAX for accessok". This commit changes TASKSIZEMAX to be LONGMAX to optimize accessok, because the previous TASKSIZEMAX defau...

CVE-2025-60535

A Cross-Site Request Forgery CSRF in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary operations via a crafted GET request...

CVE-2025-60535

A Cross-Site Request Forgery CSRF in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary operations via a crafted GET request...

JLSEC-2025-50 Expat (aka libexpat) before 2.4.4 has a signed integer overflow in `XML_GetBuffer`, for...

Expat aka libexpat before 2.4.4 has a signed integer overflow in XMLGetBuffer, for configurations with a nonzero XMLCONTEXTBYTES...

EUVD-2025-34203

Use-after-free in MediaTrackGraphImpl::GetInstance This vulnerability affects Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4...

CVE-2025-11708

Use-after-free in MediaTrackGraphImpl::GetInstance This vulnerability affects Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4...

CVE-2025-11708

Use-after-free in MediaTrackGraphImpl::GetInstance This vulnerability affects Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4...

CVE-2025-11708

Use-after-free in MediaTrackGraphImpl::GetInstance. This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4...

CVE-2025-11708 Use-after-free in MediaTrackGraphImpl::GetInstance()

Use-after-free in MediaTrackGraphImpl::GetInstance. This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4...

CVE-2025-11708

A Use-after-free vulnerability exists in the MediaTrackGraphImpl::GetInstance() function within Mozilla Firefox , Firefox ESR , and Thunderbird . This memory safety issue allows a malicious actor to execute arbitrary code . The vulnerability affects Firefox < 144 , Firefox ESR < 140.4 , Thu...

CVE-2025-11708

Use-after-free in MediaTrackGraphImpl::GetInstance. This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4...

CVE-2025-40755

CVE-2025-40755 affects Siemens SINEC NMS prior to v4.0 SP1. The getTotalAndFilterCounts endpoint is vulnerable to SQL injection, enabling an authenticated low-priv attacker to insert data and escalate privileges. A fix is available in v4.0 SP1 or later (per PT-2025-41881; Siemens ProductCERT advi...

CVE-2025-41706

The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality...

CVE-2025-41706

CVE-2025-41706 affects the Phoenix Contact webserver used in the QUINT4-UPS/24DC/24DC/10/EIP family. The issue is a denial-of-service condition that an unauthenticated remote attacker can trigger by sending a specially crafted GET request with an over-long Content-Length header. The vulnerability...

EUVD-2025-34148

The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality...

CVE-2025-60535

A Cross-Site Request Forgery (CSRF) vulnerability exists in Wallos v4.1.1 , specifically within the /endpoints/currency/currency component. This flaw allows an attacker to execute arbitrary operations by sending a crafted GET request . While the vulnerability is confirmed across multiple sources,...