EUVD-2025-124934

In the Linux kernel, the following vulnerability has been resolved: tls: Use skdstget and dstdevrcu in getnetdevforsock. getnetdevforsock is called during setsockopt, so not under RCU. Using skdstgetsk-dev could trigger UAF. Let's use skdstget and dstdevrcu. Note that the only -ndoskgetlowerdev...

CVE-2025-40149

CVE-2025-40149 affects the Linux kernel TLS path: get_netdev_for_sock() could trigger a use-after-free if sk_dst_get(sk)->dev is used during setsockopt(). The fix replaces sk_dst_get() with __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(), and notes that the only user of ->ndo_sk_g...

CVE-2025-40149 tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().

In the Linux kernel, the following vulnerability has been resolved: tls: Use skdstget and dstdevrcu in getnetdevforsock. getnetdevforsock is called during setsockopt, so not under RCU. Using skdstgetsk-dev could trigger UAF. Let's use skdstget and dstdevrcu. Note that the only -ndoskgetlowerdev...

CVE-2025-11237

The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a Subscriber, to update arbitrary WordPress options...

Important: Red Hat Security Advisory: kea security update

An update for kea is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

kernel: netfilter: nft_tunnel: fix geneve_opt type confusion addition

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfttunnel: fix geneveopt type confusion addition When handling multiple NFTATUNNELKEYOPTSGENEVE attributes, the parsing logic should place every geneveopt structure one by one compactly. Hence, when deciding the next...

EUVD-2025-74049

The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a Subscriber, to update arbitrary WordPress options...

CVE-2025-11237

The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a Subscriber, to update arbitrary WordPress options...

CVE-2025-11237 Make Email Customizer for WooCommerce <= 1.0.6 - Subscriber+ Arbitrary Options Update

The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a Subscriber, to update arbitrary WordPress options...

CVE-2025-11237 Make Email Customizer for WooCommerce <= 1.0.6 - Subscriber+ Arbitrary Options Update

The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a Subscriber, to update arbitrary WordPress options...

CVE-2025-11237

The Make Email Customizer for WooCommerce WordPress plugin, in versions through 1.0.6 , is vulnerable to an arbitrary options update flaw. The root cause is a lack of proper authorization checks and insufficient input validation within the plugin's AJAX actions . This security weakness allows any...

RHEL 10 : kea (RHSA-2025:21006)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:21006 advisory. DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers...

CVE-2025-41001

Cross Site Scripting XSS vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'LOGOUTREDIRECT' parameter in '/soplanning/www/process/options.php'. This vulnerability could allow a remote use...

CVE-2025-41001

CVE-2025-41001: Stored XSS in SOPlanning 1.53.02 arises from insufficient validation of the LOGOUT_REDIRECT parameter in /soplanning/www/process/options.php. The issue can allow an attacker to inject crafted input that is persisted and later delivered to an authenticated user, enabling theft of c...

EUVD-2025-44042

Cross Site Scripting XSS vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'LOGOUTREDIRECT' parameter in '/soplanning/www/process/options.php'. This vulnerability could allow a remote use...

CVE-2025-41001 Cross-Site Scripting (XSS) in SOPlanning

Cross Site Scripting XSS vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'LOGOUTREDIRECT' parameter in '/soplanning/www/process/options.php'. This vulnerability could allow a remote use...

PT-2025-45610

Name of the Vulnerable Software and Affected Versions SOPlanning version 1.53.02 Description A stored Cross Site Scripting XSS issue exists in SOPlanning version 1.53.02. This is due to insufficient validation of user-supplied data. An attacker can exploit this by sending a POST request utilizing...

Unbreakable Enterprise kernel security update

5.4.17-2136.349.3.1 - i40e: add validation for ringlen param Lukasz Czapnik Orabug: 38604171 CVE-2025-39973 - i40e: increase max descriptors for XL710 Justin Bronder Orabug: 38604171 CVE-2025-39973 5.4.17-2136.349.3 - Revert 'net/mlx5e: Update and set Xon/Xoff upon MTU set' Jakub Kicinski Orabug:...

CVE-2025-60248

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WPClever WPC Product Options for WooCommerce wpc-product-options allows PHP Local File Inclusion.This issue affects WPC Product Options for WooCommerce: from n/a through = 3.1.3...

EUVD-2025-38100

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WPClever WPC Product Options for WooCommerce wpc-product-options allows PHP Local File Inclusion.This issue affects WPC Product Options for WooCommerce: from n/a through = 1.8.6...