kernel: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error

A flaw was found in the Linux kernel, where a specially crafted RPC packet could cause data corruption or trigger a system panic. This flaw allows a remote attacker who can make RPC calls to send an intentionally malformed packet, potentially compromising system integrity or causing a denial of...

Manager-io code-related vulnerabilities

Manager-io is an open source accounting software from Manager.io. It is available for Windows, Mac and Linux. A code issue vulnerability exists in Manager-io 25.7.18.2519 and prior versions, which stems from improper access control in the proxy processing component and could lead to a server-side...

Google Chrome ANGLE/GPU Input Validation Vulnerability

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from an input validation vulnerability that stems from insufficient validation of untrustworthy input by ANGLE and GPU, which can be exploited by an attacker to submit a special WEB request, which can be tricke...

Tenda O3 Wireless Access Point Code Execution

The vulnerability of the fromPingResultGet /goform/setPing function in the Tenda O3 wireless access point software lies in the issue of the operation going beyond the buffer in memory when processing the destIP parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code ...

Universal Plug and Play (UPnP) Privilege Escalation

The vulnerability of the Universal Plug and Play UPnP service in Windows operating systems is related to the use of insecure mechanisms for processing authentication data in the operating system’s memory. Exploiting this vulnerability can allow a remote attacker to increase their privileges...

ndpi:fuzz_process_packet: Heap-buffer-overflow in ndpi_match_host_subprotocol

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=4687656288321536 Project: ndpi Fuzzing Engine: afl Fuzz Target: fuzzprocesspacket Job Type: aflasanndpi Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x5040000000bc Crash State...

Arbitrary Code Injection

pyLoad-ng is vulnerable to Arbitrary Code Injection. The vulnerability is due to unsafe JavaScript evaluation caused by insecure CAPTCHA processing logic that allows unauthenticated remote attackers to execute arbitrary code in the client browser and potentially on the backend server...

CVE-2025-3753

The CVE-2025-3753 issue affects the ROS rosbag tool, specifically ROS Noetic Ninjemys and earlier. The root cause is the use of Python’s eval() to process unsanitized, user-supplied input within the rosbag filter command, enabling potential arbitrary Python code execution. Documents consistently ...

PT-2025-29939

Name of the Vulnerable Software and Affected Versions OpenCV versions prior to 4.12.0 Description OpenCV, an Open Source Computer Vision Library, contains an issue where an uninitialized pointer variable on the stack can lead to an arbitrary heap buffer write when processing crafted JPEG images...

GHSA-7XQM-7738-642X File Browser's Uncontrolled Memory Consumption vulnerability can enable DoS attack due to oversized file processing

Summary A Denial of Service DoS vulnerability exists in the file processing logic when reading a file on endpoint Filebrowser-Server-IP:PORT/files/file-name . While the server correctly handles and stores uploaded files, it attempts to load the entire content into memory during read operations...

File Browser's Uncontrolled Memory Consumption vulnerability can enable DoS attack due to oversized file processing

Summary A Denial of Service DoS vulnerability exists in the file processing logic when reading a file on endpoint Filebrowser-Server-IP:PORT/files/file-name . While the server correctly handles and stores uploaded files, it attempts to load the entire content into memory during read operations...

CLSA-2025-1752654760 libxml2: Fix of 3 CVEs

CVE-2025-49794: fix use-after-free issue triggered by processing certain elements in input XML file. - CVE-2025-49796: fix memory corruption issue triggered by processing certain sch:name elements in input XML file. - CVE-2025-6021: fix integer overflow in buffer size calculations to prevent...

PT-2025-33660 · Gnu +1 · Gpac +1

Уязвимость функции gf ac4 pres b 4 back channels present утилиты MP4Box мультимедийной платформы GPAC связана с разыменованием нулевого указателя. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

Sherpa Orchestrator Privilege Escalation

The vulnerability of the Sherpa Orchestrator component of the Sherpa RPA process automation platform is related to an error in processing authentication keys controlled by users. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

CVE-2025-53893

CVE-2025-53893 affects the filebrowser/filebrowser 2.38.0 DoS vulnerability where the server loads entire file content into memory during reads (e.g., /files/{file-name} or /api/resources/{file-name}) without size checks, enabling an authenticated user to trigger memory exhaustion and potentially...

CVE-2025-53893

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.38.0, a Denial of Service DoS vulnerability exists in the file processing logic when reading a file on endpoint...

CVE-2025-53890

pyload is an open-source Download Manager written in pure Python. An unsafe JavaScript evaluation vulnerability in pyLoad’s CAPTCHA processing code allows unauthenticated remote attackers to execute arbitrary code in the client browser and potentially the backend server. Exploitation requires no...

Google Chrome: Input validation error vulnerability

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from an input validation vulnerability that stems from insufficient validation of untrustworthy input by ANGLE and GPU, which can be exploited by an attacker to submit a special WEB request, which can be tricke...

CVE-2025-53890: Improper Control of Generation of Code

pyload is an open-source Download Manager written in pure Python. An unsafe JavaScript evaluation vulnerability in pyLoad’s CAPTCHA processing code allows unauthenticated remote attackers to execute arbitrary code in the client browser and potentially the backend server. Exploitation requires no...

Tenda FH1201 fromSafeUrlFilter Code Execution

The vulnerability of the fromSafeUrlFilter function /goform/fromSafeUrlFilter in the Tenda FH1201 router software is related to the operation that goes beyond the buffer in memory when processing the page parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code ...