CVE-2025-68224

CVE-2025-68224 is rejected/not used as stated in the Initial Description.

CVE-2025-68224 scsi: core: Fix a regression triggered by scsi_host_busy()

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix a regression triggered by scsihostbusy Commit 995412e23bb2 "blk-mq: Replace tags-lock with SRCU for tag iterators" introduced the following regression: Call trace: srcureadlock+0x30/0x80 P...

CVE-2025-68199

Mode C: The CVE-2025-68199 entry concerns the Linux kernel, where an issue in the slab allocator (mm/slub.c) arises when free_slab_obj_exts() encounters slabobj_exts already set to CODETAG_EMPTY instead of NULL. The root cause is that, after a failed then later successful alloc_slab_obj_exts(), o...

CVE-2025-68199 codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext

In the Linux kernel, the following vulnerability has been resolved: codetag: debug: handle existing CODETAGEMPTY in markobjextsempty for slabobjext When allocslabobjexts fails and then later succeeds in allocating a slab extension vector, it calls handlefailedobjextsalloc to mark all objects in t...

CVE-2025-64633 WordPress Norebro Extra plugin <= 1.6.8 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in colabrio Norebro Extra norebro-extra allows Code Injection.This issue affects Norebro Extra: from n/a through = 1.6.8...

PT-2025-51404

Name of the Vulnerable Software and Affected Versions colabrio Norebro Extra versions through 1.6.8 Description The software contains an Improper Neutralization of Script-Related HTML Tags in a Web Page issue, which can lead to Code Injection. The issue is a Basic Cross-Site Scripting XSS...

PT-2025-51637

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A regression was introduced in the Linux kernel due to a commit 995412e23bb2 related to SCSI core functionality and tag iterators. This regression is triggered by the scsi host busy...

Fedora 42 : qt6-qtdeclarative (2025-62d125612b)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-62d125612b advisory. CVE-2025-12385: Fix improper validation of img tag size in Text component parser Tenable has extracted the preceding description block directly from the Fedo...

CVE-2025-65318

When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass the built-in file protection mechanisms of both Windows OS and third-party software...

PT-2025-51612

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.18.0-rc1+ Description The Linux kernel contains a flaw related to the handling of CODETAG EMPTY in the mark objexts empty function for slab object extensions. Specifically, when a slab extension vector allocati...

CVE-2025-6966

A flaw was found in python-apt. This vulnerability allows a local attacker to cause a denial of service Denial of Service process crash via a crafted deb822 file with a malformed non-UTF-8 key. Mitigation Mitigation for this issue is either not available or the currently available options do not...

FreeBSD : Roundcube -- Multiple vulnerabilities (3a59024c-d8cf-11f0-af8c-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 3a59024c-d8cf-11f0-af8c-8447094a420f advisory. The Roundcube project reports: Cross-Site-Scripting vulnerability via SVGs animate tag Information...

Node.js: Missing AES-GCM Authentication Tag Validation and Improper Deprecation Handling

Summary: In Node.js' crypto module, the createDecipheriv states that "the authTagLength option defaults to 16 bytes and must be set to a different value if a different length is used." here The authentication tag's length is however not validated against that default value and can be truncated do...

CVE-2025-12965

The Magical Posts Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpactitletag' parameter in the Magical Posts Accordion widget in all versions up to, and including, 1.2.54 due to insufficient input sanitization and output escaping on user-supplied HTML tag name...

Stored Cross-site Scripting (XSS)

getformwork/formwork is vulnerable to stored cross-site scripting XSS. The vulnerability is due to improper sanitization of input in the blog tag field, which allows an attacker to inject malicious scripts that execute in the browser of any authenticated user accessing or editing the affected blo...

CVE-2025-13093 Devs CRM – Manage tasks, attendance and teams all together <= 1.1.8 - Missing Authorization to Unauthenticated Lead Tag Update

The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/devs-crm/v1/bulk-update' REST-API endpoint in all versions up to, and including, 1.1.8. This makes it possible...

WordPress Devs CRM – Manage tasks, attendance and teams all together plugin <= 1.1.8 - Missing Authorization to Unauthenticated Lead Tag Update vulnerability

Missing Authorization to Unauthenticated Lead Tag Update vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin Devs CRM versions = 1.1.8...

PT-2025-51991

Name of the Vulnerable Software and Affected Versions Roundcube versions prior to 1.5.12 Roundcube versions prior to 1.6.12 Description Roundcube Webmail contains a Cross-Site Scripting XSS issue stemming from the use of the animate tag within SVG documents. This allows attackers to execute...

CVE-2025-12965

The Magical Posts Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpactitletag' parameter in the Magical Posts Accordion widget in all versions up to, and including, 1.2.54 due to insufficient input sanitization and output escaping on user-supplied HTML tag name...

CVE-2025-12965

CVE-2025-12965 refers to the Magical Posts Display – Elementor Advanced Posts widgets plugin. The Wordfence intelligence entry confirms a stored XSS via the mpac_title_tag parameter in the Magical Posts Accordion widget, affecting all versions up to and including 1.2.54. Root cause: insufficient ...