Astra Linux – Vulnerability in OpenSSL

Issue summary: If an application using the SSLCIPHERfind function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL pointer dereference occurs. Impact summary: A NULL pointer dereference leads to abnormal termination of the running process, causing a Denia...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: cifs: Client: Fixed a memory leak in smb3fsCONTEXTPARSEPARAM. The user calls fsconfig twice, but when the program exits, free only frees ctx-source for the second call to fsconfig, not the first. Regarding fc-source, there is ...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: nfsd: Fixed the reference count leak in nfsdsetfhdentry. nfsd exports a “pseudo root filesystem” which is used by NFSv4 to find the various exported filesystems using LOOKUP requests from a known root filehandle. NFSv3 uses th...

WordPress Tutor LMS Pro plugin <= 3.8.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Tutor LMS Pro versions = 3.8.3...

WordPress Laurent theme <= 3.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Phat RiO - BlueRock in WordPress Theme Laurent versions = 3.1...

WordPress OneLife theme <= 3.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme OneLife versions = 3.9...

CVE-2025-71026

Tenda AX-3 v16.03.12.10CN was discovered to contain a stack overflow in the wanSpeed2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

CVE-2025-71025

CVE-2025-71025 affects Tenda AX-3: a stack overflow in the cloneType2 parameter of the fromAdvSetMacMtuWan function. The root cause is input length validation in that function, enabling a crafted request to trigger a Denial of Service. Multiple connected sources (CNVD, RH, NVD, CNNVD, CIRCL) corr...

MiracleLinux 9 : lasso-2.7.0-11.el9.3 (AXSA:2025-11104:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-11104:02 advisory. lasso: Type confusion in Entr'ouvert Lasso CVE-2025-47151 Tenable has extracted the preceding description block directly from the MiracleLinux security...

MiracleLinux 9 : php:8.3 (AXSA:2025-10557:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10557:01 advisory. php: Header parser of http stream wrapper does not handle folded headers CVE-2025-1217 php: Stream HTTP wrapper header check might omit basic auth...

MiracleLinux 8 : python3.11-3.11.13-2.el8_10 (AXSA:2025-10802:08)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10802:08 advisory. cpython: Cpython infinite loop when parsing a tarfile CVE-2025-8194 Tenable has extracted the preceding description block directly from the MiracleLinux...

Microsoft Win32k 资源管理错误漏洞

Microsoft Win32k is a system file for Windows multi-user administration by Microsoft Corporation USA. Microsoft Win32k is vulnerable to a resource management error. An attacker could exploit the vulnerability to elevate privileges. The following products and versions are affected: Windows Server...

CVE-2025-71024

Tenda AX-3 v16.03.12.10CN was discovered to contain a stack overflow in the serviceName2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

TeamSpeak 安全漏洞

TeamSpeak is a voice software from the American company TeamSpeak. A security vulnerability exists in TeamSpeak version 3.5.6, which stems from insecure file permissions and could lead to a local attacker replacing executable files...

PT-2026-2583

Tenda AX-3 v16.03.12.10 CN was discovered to contain a stack overflow in the wanSpeed2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

RHEL 8 : mariadb:10.3 (RHSA-2026:0304)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:0304 advisory. MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. Security Fixes: mariadb: MariaDB: mariadb-dump...

MiracleLinux 8 : mod_auth_openidc:2.3 (AXSA:2025-9917:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-9917:01 advisory. modauthopenidc: DoS via Empty POST in modauthopenidc with OIDCPreservePost Enabled CVE-2025-3891 Tenable has extracted the preceding description block direct...

MiracleLinux 7 : python3-3.6.8-21.0.5.0.2.el7.AXS7 (AXSA:2025-11111:08)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-11111:08 advisory. CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4435, CVE-2025-4517: fix multiple tarfile extraction filter bypasses filter=tar/filter=data...

MiracleLinux 8 : python36:3.6 (AXSA:2025-9998:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-9998:01 advisory. python-pymongo: Out-of-bounds read in bson module CVE-2024-5629 Tenable has extracted the preceding description block directly from the MiracleLinux security...

MiracleLinux 9 : php:8.3 (AXSA:2025-11640:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-11640:01 advisory. php: pgsql extension does not check for errors during escaping CVE-2025-1735 php: NULL Pointer Dereference in PHP SOAP Extension via Large XML...