CVE-2025-57087

Tenda W30E V16.01.0.19 5037 was discovered to contain a stack overflow in the countryCode parameter in the werlessAdvancedSet function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

CVE-2025-57087

Tenda W30E V16.01.0.19 5037 was discovered to contain a stack overflow in the countryCode parameter in the werlessAdvancedSet function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

CLSA-2025-1757427840 mpfr: Fix of CVE-2014-9474

CVE-2014-9474: Fix of a buffer overflow due to incorrect GMP documentation for mpnsetstr...

XAPI UTF-8 string handling

ISSUE DESCRIPTION There are multiple issues. 1. Updates to the XAPI database sanitise input strings, but try generating the notification using the unsanitised input. This causes the database's event thread to terminate and cease further processing. 2. XAPI's UTF-8 encoder implements v3.0 of the...

CLSA-2025-1757409276 mpfr: Fix of CVE-2014-9474

CVE-2014-9474: Fix of a buffer overflow due to incorrect GMP documentation for mpnsetstr...

CVE-2025-10123

A vulnerability was determined in D-Link DIR-823X up to 250416. Affected by this vulnerability is the function sub415028 of the file /goform/setstaticleases. Executing manipulation of the argument Hostname can lead to command injection. The attack can be launched remotely. The exploit has been...

CVE-2025-10123 D-Link DIR-823X set_static_leases sub_415028 command injection

A vulnerability was determined in D-Link DIR-823X up to 250416. Affected by this vulnerability is the function sub415028 of the file /goform/setstaticleases. Executing manipulation of the argument Hostname can lead to command injection. The attack can be launched remotely. The exploit has been...

CVE-2025-10123

D-Link DIR-823X routers up to firmware 250416 contain a command injection flaw in the sub_415028 function of /goform/set_static_leases, caused by insufficient input validation of the Hostname parameter. A remote unauthenticated attacker can execute arbitrary commands by sending a crafted request....

PT-2025-39755

Name of the Vulnerable Software and Affected Versions D-Link DIR-823X version 250416 Description A flaw exists in the D-Link DIR-823X, specifically within the sub 412E7C function located in the /goform/set switch settings file. Manipulation of the port argument can lead to command injection. This...

D-Link DIR-823X command injection vulnerability

The D-Link DIR-823X is a wireless router from China's AUO D-Link. The D-Link DIR-823X suffers from a command injection vulnerability due to a flaw in the sub415028 function in the goform/setsticleases file. An attacker can exploit the vulnerability to execute arbitrary commands on the system...

GHSA-6W2R-R2M5-XQ5W Django is subject to SQL injection through its column aliases

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed QuerySet.annotate or QuerySet.alias...

Google Android elevation of privilege vulnerability (CNVD-2025-23026)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that is caused by a logic error in the setDisplayName function in AssociationRequest.java that causes the application to retain the CDM association. An...

CVE-2025-39732

Public technical details for CVE-2025-39732 are not present in the provided Connected documents. The initial description notes the ath11k/mac fix, but no vendor/product/version specifics or exploit information are disclosed here. Monitor for updates.

CVE-2025-7040 Cloud SAML SSO <= 1.0.19 - Missing Authorization to Unauthenticated Settings Modification via set_organization_settings Action

The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setorganizationsettings' action of the cssohandleactions function in all versions up to, and including, 1.0.19. The handler reads client-supplied POST parameters fo...

CVE-2025-7040 Cloud SAML SSO <= 1.0.19 - Missing Authorization to Unauthenticated Settings Modification via set_organization_settings Action

The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setorganizationsettings' action of the cssohandleactions function in all versions up to, and including, 1.0.19. The handler reads client-supplied POST parameters fo...

CVE-2025-39712

In the Linux kernel, the following vulnerability has been resolved: media: mt9m114: Fix deadlock in getframeinterval/setframeinterval Getting / Setting the frame interval using the V4L2 subdev pad ops getframeinterval/setframeinterval causes a deadlock, as the subdev state is locked in the 1 but...

UBUNTU-CVE-2025-39689

In the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files Currently the reader of setftracefilter and setftracenotrace just adds the pointer to the global tracer hash to its iterator. Unlike the writer that allocates a copy...

CVE-2025-39712

The CVE-2025-39712 issue affects the Linux kernel media/mt9m114 driver. The deadlock occurred when using V4L2 subdev pad ops get_frame_interval/set_frame_interval due to locking in the subdev state plus the driver. The fix removes the redundant lock operations from mt9m114_ifp_get_frame_interval(...

CVE-2025-39712 media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval

In the Linux kernel, the following vulnerability has been resolved: media: mt9m114: Fix deadlock in getframeinterval/setframeinterval Getting / Setting the frame interval using the V4L2 subdev pad ops getframeinterval/setframeinterval causes a deadlock, as the subdev state is locked in the 1 but...

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2024-46733: btrfs: fix qgroup reserve leaks in cowfilerange bsc1230708. CVE-2025-38006: net: mctp: Do not access ifaindex when missing bsc1244930...