ROS-20251113-02

The Webmin hosting control panel vulnerability involves manipulating the Host header to inject a malicious domain into a password reset email. malicious domain in a password reset link email. Exploitation of the vulnerability could allow an attacker acting remotely to intercept the password reset...

CVE-2023-7329

Summary: Tinycontrol LAN Controller v3 LK3 firmware up to 1.58a (HW v3.8) has a missing authentication vulnerability in the stm.cgi endpoint. An unauthenticated, remote attacker can send crafted requests to reboot the device or restore factory settings, causing DoS and configuration loss (no publ...

CVE-2023-7329 Tinycontrol LAN Controller v3 (LK3) Remote DoS

Tinycontrol LAN Controller v3 LK3 firmware versions up to 1.58a hardware v3.8 contain a missing authentication vulnerability in the stm.cgi endpoint. A remote, unauthenticated attacker can send crafted requests to forcibly reboot the device or restore factory settings, leading to a denial of...

CVE-2023-7329 Tinycontrol LAN Controller v3 (LK3) Remote DoS

Tinycontrol LAN Controller v3 LK3 firmware versions up to 1.58a hardware v3.8 contain a missing authentication vulnerability in the stm.cgi endpoint. A remote, unauthenticated attacker can send crafted requests to forcibly reboot the device or restore factory settings, leading to a denial of...

MAL-2025-152979 Malicious code in astia-alao-mafadiaf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 053a313b5a3ba92638049004049563cb2852b499fff8efd3e2653055badca1ce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-124938

In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: Fix double cleanup on devmaddactionorreset failure When devmaddactionorreset fails, it calls the passed cleanup function. Hence the caller must not repeat that cleanup. Replace the "goto errregulatorfree" by the actu...

CVE-2025-40145

CVE-2025-40145 concerns the Linux kernel, where the PCI/pwrctrl path had a double-cleanup issue on failure of devm_add_action_or_reset(). The root cause is that when devm_add_action_or_reset() fails, it invokes the provided cleanup function, so the caller must not perform a second cleanup. The fi...

CVE-2025-40145 PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure

In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: Fix double cleanup on devmaddactionorreset failure When devmaddactionorreset fails, it calls the passed cleanup function. Hence the caller must not repeat that cleanup. Replace the "goto errregulatorfree" by the actu...

CVE-2025-40145

In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: Fix double cleanup on devmaddactionorreset failure When devmaddactionorreset fails, it calls the passed cleanup function. Hence the caller must not repeat that cleanup. Replace the "goto errregulatorfree" by the actu...

CVE-2025-11999

The Add Multiple Marker plugin for WordPress is vulnerable to unauthorized modification of data to due to a missing capability check on the addmultiplemarkerresetmap and ammsavemapapi functions in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to upda...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990823)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990823 advisory. In the Linux kernel, the following vulnerability has been resolved: PCI: Add missing bridge lock to pcibuslock One of the true positives that the cfgaccesslock...

PT-2025-46734

Name of the Vulnerable Software and Affected Versions Tinycontrol LAN Controller versions up to 1.58a hardware v3.8 Description The Tinycontrol LAN Controller v3 LK3 firmware has a missing authentication check. An attacker who is not authenticated can send specially crafted requests to the stm.cg...

kernel: zram: fix potential UAF of zram table

In the Linux kernel, the following vulnerability has been resolved: zram: fix potential UAF of zram table If zrammetaalloc failed early, it frees allocated zram-table without setting it NULL. Which will potentially cause zrammetafree to access the table if user reset an failed and uninitialized...

CVE-2025-12526

The Private Google Calendars plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pgcremove' action in all versions up to, and including, 20250811. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2025-12866

EIP Plus developed by Hundred Plus has a Weak Password Recovery Mechanism vulnerability, allowing unauthenticated remote attacker to predict or brute-force the 'forgot password' link, thereby successfully resetting any user's password...

CVE-2025-11999 Add Multiple Marker <= 1.2 - Missing Authorization to Unauthenticated Settings Update

The Add Multiple Marker plugin for WordPress is vulnerable to unauthorized modification of data to due to a missing capability check on the addmultiplemarkerresetmap and ammsavemapapi functions in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to upda...

CVE-2025-11999

CVE-2025-11999 concerns the WordPress plugin Add Multiple Marker. A missing capability check in addmultiplemarker_reset_map() and amm_save_map_api() allows unauthenticated users to modify map settings (update the map API and reset maps) in all versions up to and including 1.2. Public sources (Wor...

CVE-2025-12526

CVE-2025-12526 concerns the Private Google Calendars plugin for WordPress. Technical details in connected sources show a missing capability check on the pgc_remove action in versions up to 20250811, enabling authenticated attackers with Subscriber-level access or higher to reset the plugin’s sett...

MAL-2025-73917 Malicious code in kresna-mieaceh93-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cd77baa9497d71ed6bcc87f37b9a1a5c6d50655e874905aa99e3317c1238540 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46270

Name of the Vulnerable Software and Affected Versions Add Multiple Marker plugin for WordPress versions up to and including 1.2 Description The Add Multiple Marker plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check in the addmultiplemarker...