CVE-2025-26453

In isContentUriForOtherUser of BluetoothOppSendFileInfo.java, there is a possible cross user data leak due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-38690

In the Linux kernel, the following vulnerability has been resolved: drm/xe/migrate: prevent infinite recursion If the buf + offset is not aligned to XECAHELINEBYTES we fallback to using a bounce buffer. However the bounce buffer here is allocated on the stack, and the only alignment requirement...

CVE-2025-38682

In the Linux kernel, the following vulnerability has been resolved: i2c: core: Fix double-free of fwnode in i2cunregisterdevice Before commit df6d7277e552 "i2c: core: Do not dereference fwnode in struct device", i2cunregisterdevice only called fwnodehandleput on ofnode-s in the form of calling...

CVE-2025-38686

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: fix a crash in UFFDIOMOVE when PMD is a migration entry When UFFDIOMOVE encounters a migration PMD entry, it proceeds with obtaining a folio and accessing it even though the entry is swpentryt. Add the missing check...

CVE-2025-57263

creationtimestamp| type| source ---|---|--- 2025-09-04 13:37:41+00:00| seen| https://gist.github.com/Darkcrai86/7c380c6a6550b26103f513a79fee0c4b 2025-09-04 15:24:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lxzhcnfmtv2v 2025-09-05 21:02:23+00:00| seen|...

MINI-CVJG-W5F9-8QHW

Bulletin has no description...

CVE-2024-29029

creationtimestamp| type| source ---|---|--- 2025-09-04 09:36:53+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-29029.yaml 2025-09-05 21:02:24+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3ly4knrbage2t 2025-09-27...

GNU Binutils DWARF Section dwarf.c process_debug_info memory leak

...

firmware: cs_dsp: Fix OOB memory read access in KUnit test (wmfw info)

...

vmxnet3: unregister xdp rxq info in the reset path

...

smb: client: fix use-after-free in smb2_query_info_compound()

...

btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info()

...

A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.

...

Linux Distros Unpatched Vulnerability : CVE-2021-45473

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL aka a page-information sidebar...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the extractImageInfo function for user avatars. An attacker can execute arbitrary scripts in the context of another user by uploading malicious files that are served without proper content type validation...

CVE-2024-43166

creationtimestamp| type| source ---|---|--- 2025-09-03 05:19:17+00:00| seen| https://seclists.org/oss-sec/2025/q3/145 2025-09-03 07:36:00+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3lxw4nynoqs2f 2025-09-03 13:14:54+00:00| seen|...

CVE-2025-58607: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in GDPR Info Cookie Notice & Consent Banner for GDPR & CCPA Compliance cookie-notice-and-consent-banner allows Stored XSS.This issue affects Cookie Notice & Consent Banner for GDPR & CCPA Compliance:...

CVE-2024-49728

In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-22428

In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible way to grant permissions to an app on the secondary user from the primary user due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User...

CVE-2024-49728

In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...