CVE-2025-57728

In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files...

Linux Distros Unpatched Vulnerability : CVE-2024-47813

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime is an open source runtime for WebAssembly. Under certain concurrent event orderings, a wasmtime::Engine's internal type registry was susceptible to...

Italian hotels breached for tens of thousands of scanned IDs

The Computer Emergency Response Team CERT for Italy's "Agenzia per l’Italia Digitale" AGID issued a warning that cybercriminals are selling stolen identity documents from hotels operating in Italy. This summer, a criminal hacker group named “mydocs” infiltrated the booking systems of at least ten...

PT-2025-46741

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.16.0-rc7 Description The Linux kernel contains an issue within the KVM component, specifically related to debug checking for non-physical np guests utilizing huge mappings on the arm64 architecture. When runnin...

Linux Distros Unpatched Vulnerability : CVE-2022-33744

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree to keep track of the foreign mappings. Updating of tha...

Linux Distros Unpatched Vulnerability : CVE-2020-15852

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in the Linux kernel 5.5 through 5.7.9, as used in Xen through 4.13.x for x86 PV guests. An attacker may be granted the I/O port...

Linux Distros Unpatched Vulnerability : CVE-2023-34324

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console...

Linux Distros Unpatched Vulnerability : CVE-2021-43056

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in the Linux kernel for powerpc before 5.14.15. It allows a malicious KVM guest to crash the host, when the host is running on Power8, d...

CLSA-2025-1751551161 Update of grub2

Improve Xen detection so we don't set GRUBENABLEBLSCFG=false for HVM domU guests - Debrand for Cloudlinux...

CVE-2025-46708

Software installed and running inside a Guest VM may conduct improper GPU system calls to prevent other Guests from running work on the GPU...

Siemens多款产品 安全漏洞

Siemens RUGGEDCOM RST2428P and others are a server communication device from Siemens Canada. A security vulnerability exists in various Siemens products that stems from improper authorization checking, which could allow an authenticated remote attacker to execute out-of-privilege system commands...

CVE-2022-42317

Xenstore: guests can let run xenstored out of memory This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service...

CVE-2022-42322

Xenstore: Cooperating guests can create arbitrary numbers of nodes This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Since the fix of XSA-322 any Xenstore node owned by a removed domain will be modified to be owned by...

CVE-2022-42323

Xenstore: Cooperating guests can create arbitrary numbers of nodes This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Since the fix of XSA-322 any Xenstore node owned by a removed domain will be modified to be owned by...

CVE-2022-33744

Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree to keep track of the foreign mappings. Updating of that rbtree is not always done completely with the related lock held, resulting in a small race window, which can be used by unprivileged...

CVE-2022-42318

Xenstore: guests can let run xenstored out of memory This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service...

CVE-2022-32055

Inout Homestay v2.2 was discovered to contain a SQL injection vulnerability via the guests parameter at /index.php?page=search/rentals...

CVE-2021-28705

issues with partially successful P2M updates on x86 This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. x86 HVM and PVH guests may be started in populate-on-demand PoD mode, to provide a way for them to later easily have...

CVE-2014-8293

Cross-site scripting XSS vulnerability in Voice Of Web AllMyGuests 0.4.1 allows remote attackers to inject arbitrary web script or HTML via the AMGsignintopic parameter to index.php...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to improper validation of team invite permissions. An attacker can bypass access restrictions by exploiting the API to add unauthorized guest users to a team. Note: This is only exploitable if the attacker is...