CVE-2025-40100

The CVE-2025-40100 issue is in the Linux kernel, specifically the Btrfs code path used when building the free space tree. The problem was an assertion in populate_free_space_tree() that assumed a block group item always exists in the extent tree when not using the block group tree feature. This c...

CVE-2025-40100 btrfs: do not assert we found block group item when creating free space tree

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not assert we found block group item when creating free space tree Currently, when building a free space tree at populatefreespacetree, if we are not using the block group tree feature, we always expect to find block...

CVE-2025-12222

A security vulnerability has been detected in Bdtask Flight Booking Software up to 3.1. Affected by this issue is some unknown functionality of the file /admin/transaction/deposit of the component Deposit Handler. The manipulation leads to unrestricted upload. The attack can be initiated remotely...

CVE-2023-53701 netfilter: nf_tables: deactivate anonymous set from preparation phase

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: deactivate anonymous set from preparation phase backport for 4.14 of c1592a89942e9678f7d9c8030efa777c0d57edab Toggle deleted anonymous sets as inactive in the next generation, so users cannot perform any upda...

CVE-2023-53701

CVE-2023-53701 has been rejected by its CNA; this CVE ID is not active.

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987602)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987602 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction AV/C deferred transactio...

GHSA-XVP7-8VM8-XFXX Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers

Summary The GoCardless components in Actualbudget in are logging responses to STDOUT in a parsed format using console.logand console.debug Which in this version of node is an alias for console.log. This is exposing sensitive information in log files including, but not limited to: - Gocardless...

Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers

Summary The GoCardless components in Actualbudget in are logging responses to STDOUT in a parsed format using console.logand console.debug Which in this version of node is an alias for console.log. This is exposing sensitive information in log files including, but not limited to: - Gocardless...

Security Bulletin: IBM Financial Transaction Manager is impacted by multiple vulnerabilities in RedHat Proxy for Kubernetes RBAC authorization

Summary IBM Financial Transaction Manager for RedHat OpenShift has addressed the following vulnerabilities. Vulnerability Details CVEID:CVE-2025-53905 DESCRIPTION: Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim’s tar.vim plugin can allow...

CVE-2025-11728

The Oceanpayment CreditCard Gateway plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'returnpayment' and 'noticepayment' functions in all versions up to, and including, 6.0. This makes it possibl...

EUVD-2025-34540

The Oceanpayment CreditCard Gateway plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'returnpayment' and 'noticepayment' functions in all versions up to, and including, 6.0. This makes it possibl...

CVE-2025-11728 Oceanpayment CreditCard Gateway <= 6.0 - Missing Authentication to Unauthenticated Order Status Update

The Oceanpayment CreditCard Gateway plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'returnpayment' and 'noticepayment' functions in all versions up to, and including, 6.0. This makes it possibl...

CVE-2025-11728

CVE-2025-11728 affects the Oceanpayment CreditCard Gateway plugin for WordPress (versions up to 6.0). The root cause is missing authentication and capability checks in the return_payment and notice_payment functions, allowing unauthenticated and unauthorized modification of data. The practical im...

io_uring/tctx: work around xa_store() allocation error issue

...

CVE-2025-11431

A vulnerability was determined in code-projects Web-Based Inventory and POS System 1.0. The impacted element is an unknown function of the file /transaction.php. This manipulation of the argument shopid causes sql injection. The attack is possible to be carried out remotely. The exploit has been...

CVE-2025-11431

A vulnerability was determined in code-projects Web-Based Inventory and POS System 1.0. The impacted element is an unknown function of the file /transaction.php. This manipulation of the argument shopid causes sql injection. The attack is possible to be carried out remotely. The exploit has been...

CVE-2025-11431

Code-Projects Web-Based Inventory and POS System 1.0 contains an SQL injection in the /transaction.php file, triggered by manipulating the shopid parameter in an unknown function. Remote exploitation is possible, and public disclosure of the exploit is noted in multiple sources. Affected componen...

CVE-2025-11431 code-projects Web-Based Inventory and POS System transaction.php sql injection

A vulnerability was determined in code-projects Web-Based Inventory and POS System 1.0. The impacted element is an unknown function of the file /transaction.php. This manipulation of the argument shopid causes sql injection. The attack is possible to be carried out remotely. The exploit has been...

CVE-2025-11431 code-projects Web-Based Inventory and POS System transaction.php sql injection

A vulnerability was determined in code-projects Web-Based Inventory and POS System 1.0. The impacted element is an unknown function of the file /transaction.php. This manipulation of the argument shopid causes sql injection. The attack is possible to be carried out remotely. The exploit has been...

Linux Distros Unpatched Vulnerability : CVE-2022-50436

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ext4: don't set up encryption key during jbd2 transaction Commit a80f7fcf1867 ext4: fixup...