EUVD-2025-205148

In the Linux kernel, the following vulnerability has been resolved: vmcihost: fix a race condition in vmcihostpoll causing GPF During fuzzing, a general protection fault is observed in vmcihostpoll. general protection fault, probably for non-canonical address 0xdffffc0000000019: 0000 1 PREEMPT SM...

EUVD-2025-205172

In the Linux kernel, the following vulnerability has been resolved: ping: Fix potentail NULL deref for /proc/net/icmp. After commit dbca1596bbb0 "ping: convert to RCU lookups, get rid of rwlock", we use RCU for ping sockets, but we should use spinlock for /proc/net/icmp to avoid a potential NULL...

CVE-2025-68747

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix UAF on kernel BO VA nodes If the MMU is down, panthorvmunmaprange might return an error. We expect the page table to be updated still, and if the MMU is blocked, the rest of the GPU should be blocked too, so no...

CVE-2025-68360

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks MT7996 driver can use both wed and wedhif2 devices to offload traffic from/to the wireless NIC. In the current codebase we assume to always use the primary w...

CVE-2025-68729

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix MSDU buffer types handling in RX error path Currently, packets received on the REO exception ring from unassociated peers are of MSDU buffer type, while the driver expects link descriptor type packets. These...

CVE-2025-68357

In the Linux kernel, the following vulnerability has been resolved: iomap: allocate sdiodonewq for async reads as well Since commit 222f2c7c6d14 "iomap: always run error completions in user context", read error completions are deferred to sdiodonewq. This means the workqueue also needs to be...

WordPress URL Shortify plugin <= 1.11.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Nguyễn Đức Toàn in WordPress Plugin URL Shortify versions = 1.11.2...

CVE-2025-68667

creationtimestamp| type| source ---|---|--- 2025-12-24 02:13:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3map6ulucya2q...

RockyLinux 10 : python3.12 (RLSA-2025:23940)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:23940 advisory. cpython: python: Python zipfile End of Central Directory EOCD Locator record offset not checked CVE-2025-8291 Tenable has extracted the preceding description...

CVE-2025-13699

MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors m...

EUVD-2025-204822

CMSimple 5.4 contains a cross-site scripting vulnerability that allows attackers to bypass input filtering by using HTML to Unicode encoding. Attackers can inject malicious scripts by encoding payloads like '-alert1// and execute arbitrary JavaScript when victims interact with delete buttons...

CVE-2025-14402

PDFsam Enhanced DOC File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2025-14372 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2025-68338

In the Linux kernel, the following vulnerability has been resolved: net: dsa: microchip: Don't free uninitialized kszirq If something goes wrong at setup, kszirqfree can be called on uninitialized kszirq for example when kszptpirqsetup fails. It leads to freeing uninitialized IRQ numbers and/or...

CVE-2025-68339

In the Linux kernel, the following vulnerability has been resolved: atm/fore200e: Fix possible data race in fore200eopen Protect access to fore200e-availablecellrate with ratemtx lock in the error handling path of fore200eopen to prevent a data race. The field fore200e-availablecellrate is a shar...

DEBIAN-CVE-2025-67108

eProsima Fast-DDS v3.3 was discovered to contain improper validation for ticket revocation, resulting in insecure communications and connections...

CVE-2025-14635

creationtimestamp| type| source ---|---|--- 2025-12-23 13:08:55+00:00| seen| https://gist.github.com/Darkcrai86/71c204b3b0ba778f7ea8936118f302ad 2025-12-23 13:34:00+00:00| seen| https://gist.github.com/Darkcrai86/4bc120072132e5d041512b321f39204b...

CVE-2025-47761

creationtimestamp| type| source ---|---|--- 2025-12-23 12:16:46+00:00| seen| https://poliverso.org/objects/0477a01e-47032880-2067098942d068cb 2025-12-23 12:18:57+00:00| seen| https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3manq5hlshov2...

CVE-2025-67436

creationtimestamp| type| source ---|---|--- 2025-12-22 23:19:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mamep4fu6g2q 2026-01-02 18:48:53+00:00| published-proof-of-concept| Telegram/YF7SiVU4fRdeEbPrgEybP1PhAHJtxgx2UciXBwDQ1HiRhM...

CVE-2025-67289

creationtimestamp| type| source ---|---|--- 2025-12-22 19:44:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3malyn66f2s2r 2025-12-23 05:34:48+00:00| seen| https://infosec.exchange/users/offseq/statuses/115767252484769956 2025-12-23 09:16:50+00:00| seen|...