CVE-2025-37776

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smbbreakalllevIIoplock There is a room in smbbreakalllevIIoplock that can cause racy issues when unlocking in the middle of the loop. This patch use read lock to protect whole loop...

CVE-2025-37774

The CVE-2025-37774 entry describes a Linux kernel slab allocator issue where slab->obj_exts may be left non-zero on newly allocated slabs, causing invalid pointer dereferences and potential Oops/panic during buffered I/O operations. Investigation notes that bits in slab->obj_exts could esca...

CVE-2025-37752

CVE-2025-37752 is a Linux kernel vulnerability affecting the scheduler, specifically net_sched: sch_sfq. The root cause is that limit validation could be bypassed if the limit was indirectly updated as other parameters changed. The fix moves the limit validation to the end of the configuration up...

CVE-2025-37747

In the Linux kernel, the following vulnerability has been resolved: perf: Fix hang while freeing sigtrap event Perf can hang while freeing a sigtrap event if a related deferred signal hadn't managed to be sent before the file got closed: perfeventoverflow taskworkaddperfpendingtask fput...

CVE-2025-37746

In the Linux kernel, the following vulnerability has been resolved: perf/dwcpcie: fix duplicate pcidev devices During platformdeviceregister, wrongly using struct device pcidev as platformdata caused a kmemdup copy of pcidev. Worse still, accessing the duplicated device leads to list corruption a...

CVE-2025-37742

In the Linux kernel, the following vulnerability has been resolved: jfs: Fix uninit-value access of imap allocated in the diMount function syzbot reports that hexdumptobuffer is using uninit-value: ===================================================== BUG: KMSAN: uninit-value in...

CVE-2025-3503

creationtimestamp| type| source ---|---|--- 2025-05-01 06:13:50+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14239 2025-05-01 09:55:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lo426aydww2p 2025-05-01 10:39:11+00:00| seen|...

CVE-2025-3504

creationtimestamp| type| source ---|---|--- 2025-05-01 06:13:49+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/14238 2025-05-01 09:55:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lo426b7bib2r 2025-05-01 10:39:08+00:00| seen| https://t.me/cvedetector/24194...

CVE-2025-1305

The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due to missing or incorrect nonce validation on the newsbloggerinstallandactivateplugin function. This makes it possible for unauthenticated attackers to upload...

CVE-2025-2816

The Page View Count plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the yellowmessagedontshow function in versions 2.8.0 to 2.8.4. This makes it possible for authenticated attackers, with...

CVE-2025-4146

creationtimestamp| type| source ---|---|--- 2025-05-01 02:14:00+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14214 2025-05-01 03:48:36+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114430529763357297 2025-05-01 04:00:52+00:00|...

CVE-2025-46629

CVE-2025-46629 affects Tenda RX2 Pro (firmware 16.03.30.14). The issue is a lack of access controls in the 'ate' management binary, enabling an unauthenticated remote attacker to perform unauthorized configuration changes on any router where 'ate' is enabled by sending a crafted UDP packet. The a...

CVE-2024-30146 HCL Domino Leap is affected by improper access control

Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem...

CVE-2022-42449

Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications...

WordPress Page View Count plugin 2.8.0-2.8.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update

Missing Authorization to Authenticated Subscriber+ Limited Options Update vulnerability discovered by kr0d in WordPress Plugin Page View Count versions 2.8.0-2.8.4...

CVE-2025-46554 XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API

XWiki is a generic wiki platform. In versions starting from 1.8.1 to before 14.10.22, from 15.0-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.7.0, anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint...

CVE-2025-24091

An app could impersonate system notifications. Sensitive notifications now require restricted entitlements. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.3. An app may be able to cause a denial-of-service...

CVE-2025-30390 Azure ML Compute Elevation of Privilege Vulnerability

...

CVE-2025-32974

creationtimestamp| type| source ---|---|--- 2025-04-30 15:48:37+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114427698650906062 2025-04-30 16:30:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lo27ru3j5p2h 2025-04-30 17:32:01+00:00| seen|...

CVE-2025-32376

Discourse is an open-source discussion platform. Prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the users limit for a DM can be bypassed, thus giving the ability to potentially create a DM with every user from a site in it. This issue has been patched in stable...