8129 matches found
CLSA-2025-1762449077 Fix CVE(s): CVE-2023-30630
SECURITY UPDATE: Overwrite a local file - debian/patches/CVE-2023-30630.patch: Prevent --dump-bin from overwriting local files to address privilege escalation vulnerability - CVE-2023-30630...
CVE-2025-12582
The Features plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'featuresrevertoption AJAX endpoint in all versions up to, and including, 0.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above...
CVE-2025-12350
The DominoKit plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpajaxnoprivdominokitoptionadminaction AJAX endpoint in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to update plugin settings...
CVE-2025-12582
The Features plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'featuresrevertoption AJAX endpoint in all versions up to, and including, 0.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above...
CVE-2025-12582 Features <= 0.0.2 - Missing Authorization to Authenticated (Subscriber+) Option Reset
The Features plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'featuresrevertoption AJAX endpoint in all versions up to, and including, 0.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above...
CVE-2025-12582 Features <= 0.0.2 - Missing Authorization to Authenticated (Subscriber+) Option Reset
The Features plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'featuresrevertoption AJAX endpoint in all versions up to, and including, 0.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above...
CVE-2025-12582
The CVE-2025-12582 vulnerability affects the WordPress Features plugin up to version 0.0.2, caused by a missing capability check on the features_revert_option AJAX endpoint. This allows authenticated users with Subscriber-level access (and above) to modify data by reverting options, exposing unau...
Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989300)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989300 advisory. In the Linux kernel, the following vulnerability has been resolved: schcake: Fix out of bounds when parsing TCP options and header The TCP option parser in cake qdis...
PT-2026-2501
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.18.0-rc2+ 721 Description An issue exists in the Linux kernel's F2FS filesystem implementation where an incorrect return value from the f2fs recover fsync data function can lead to a kernel panic. Specifically,...
curl: Directory Traversal Vulnerability in cURL via Content-Disposition Header Processing
Vulnerability Description The parsefilename function in src/toolcbhdr.c does not adequately validate and sanitize filenames extracted from HTTP Content-Disposition headers, allowing directory traversal attacks when the -O remote-name and -J remote-header-name options are used together. Vulnerable...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fixed a socket memory leak in the handling of TCP-AO failures for IPv6. When tcpaocopyallmatching fails in tcpv6synrecvsock, the function simply exits. This results in a memory leak: unreferenced object 0xffff0000281a820...
Astra Linux - уязвимость в glib2.0
GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in goptiongroupaddentries. NOTE: the vendor's position is "Realistically this is not a security issue. The standard pattern is for callers to provide a static list of option entries in a fixed number of...
CVE-2025-64118
node-tar is a Tar for Node.js. In 7.5.1, using .t aka .list with sync: true to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2...
Apache Airflow's create action can upsert existing Pools/Connections/Variables
User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action...
CVE-2025-54470
Summary: CVE-2025-54470 affects NeuVector telemetry sender when the “Report anonymous cluster data” option is enabled. The root cause is failure to verify the telemetry server’s TLS certificate and hostname, enabling MITM attacks, and unbounded in-memory loading of the server response, enabling p...
PT-2025-44433
Name of the Vulnerable Software and Affected Versions Keras versions prior to 3.12 Description The keras.utils.get file API is susceptible to a path traversal attack when the extract=True option is used for tar archives. The issue occurs because the extract archive function calls Python's...
Virtuozzo Hybrid Infrastructure 7.1 Hotfix 1 (7.1.0-187)
This update provides important security fixes. Vulnerability id: VSTOR-89294 A fix for volume attachment. Vulnerability id: VSTOR-107377 Failed to move domains to a mount point during an update. Vulnerability id: VSTOR-111693 A stability fix for QEMU. Vulnerability id: VSTOR-115326 Failed to set...
CVE-2025-11232
A flaw was found in Kea. A remote attacker can send specific option content to the kea-dhcp4 server. When the server is configured with specific parameters, an assertion failure can be triggered and cause the kea-dhcp4 process to exit unexpectedly, resulting in a denial of service. Mitigation Set...
CVE-2025-11232
To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "^A-Za-z0-9.-"; "hostname-char-replacement" must be empty the default; and "ddns-qualifying-suffix" must NOT be empty the default is empty. DDNS...