CVE-2022-49809

In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix skb leak in x25lapbreceiveframe x25lapbreceiveframe using skbcopy to get a private copy of skb, the new skb should be freed in the undersized/fragmented skb error handling path. Otherwise there is a memory leak...

CVE-2025-37796

In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x: fix use after free access in at76disconnect The memory pointed to by priv is freed at the end of at76deletedevice function using ieee80211freehw. But the code then accesses the udev field of the freed object to pu...

CVE-2022-49911

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: enforce documented limit to prevent allocating huge memory Daniel Xu reported that the hash:net,iface type of the ipset subsystem does not limit adding the same network with different interfaces to a set, which...

PT-2025-18748 · Flowring Technology · Agentflow

Name of the Vulnerable Software and Affected Versions: Agentflow from Flowring Technology affected versions not specified Description: The issue allows unauthenticated remote attackers to perform password brute force attacks by bypassing account lockout protection. Recommendations: At the moment,...

NETGEAR JWNR2000 注入漏洞

The NETGEAR JWNR2000v2 is a wireless router from NETGEAR. The NETGEAR JWNR2000v2 suffers from a command injection vulnerability that stems from the cmdwireless function parameter host failing to properly filter constructor command special characters, commands, and so on. No details of the...

PT-2025-18019 · Ververica · Ververica Platform

Name of the Vulnerable Software and Affected Versions: Ververica Platform version 2.14.0 Description: The issue is a Reflected XSS vulnerability. It can be exploited via a "namespaces/default/formats" URI. Recommendations: For Ververica Platform version 2.14.0, consider restricting access to the...

CVE-2024-6198

The device exposes a web interface on ports TCP/3030 and TCP/9882. This web service runs lighttpd, which implements the “SNORE” interface. This interface is affected by a stack buffer overflow vulnerability due to insecure path parsing. An attacker with access to the LAN network interface could u...

PT-2025-20352

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A potential use-after-free UAF issue in the hfsc dequeue function has been resolved. The fix aims to safeguard this function, similar to a previous patch. However, a reliable reproducer...

CVE-2024-10306

A vulnerability was found in modproxycluster. The issue is that the directive should be replaced by the directive as the former does not restrict IP/host access as Require ip IPADDRESS would suggest. This means that anyone with access to the host might send MCMP requests that may result in...

Host Header Injection

Overview croogo/croogo is an Open Source CMS built for everyone. Affected versions of this package are vulnerable to Host Header Injection in the feed.rss component, which takes the content of the -H argument in a request and passes it through to the element in a response without filtering. An...

CVE-2025-43961

In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment,...

CVE-2025-43962

A flaw was found in LibRaw. In affected versions, phaseonecorrect in decoders/loadmfbacks.cpp has out-of-bounds reads for tag 0x412 processing. This issue is related to large w0 or w1 values or the frac and mult calculations. Mitigation Mitigation for this issue is either not available or the...

CVE-2025-38240

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: dp: drmerr = deverr in HPD path to avoid NULL ptr The function mtkdpwaithpdasserted may be called before the mtkdp-drmdev pointer is assigned in mtkdpbridgeattach. Specifically it can be called via this callpath: -...

CVE-2025-22117

In the Linux kernel, the following vulnerability has been resolved: ice: fix using untrusted value of pktlen in icevcfdirparseraw Fix using the untrusted value of proto-raw.pktlen in function icevcfdirparseraw by verifying if it does not exceed the VIRTCHNLMAXSIZERAWPACKET value...

CVE-2025-22102

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix kernel panic during FW release This fixes a kernel panic seen during release FW in a stress test scenario where WLAN and BT FW download occurs simultaneously, and due to a HW bug, chip sends out only 1...

PT-2025-17217 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A use after free bug has been identified in the Linux kernel. The issue occurs after calling netif rx niskb, where dereferencing skb becomes unsafe. Specifically, the can frame cf whic...

Drupal Google Optimize 安全漏洞

Drupal Google Optimize is an online split testing tool for the Drupal community. A security vulnerability exists in Drupal Google Optimize. No information about this vulnerability is available at this time, so stay tuned to CNNVD or the vendor announcement...

SUSE CVE-2025-2814

Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. This issue affects operating systems where "/dev/urandom'" is unavailable. In that case, Crypt::CBC will fallback to u...

PT-2025-16424 · Oracle · Oracle Solaris

Name of the Vulnerable Software and Affected Versions: Oracle Solaris version 11 Description: The issue affects the Filesystem component of Oracle Solaris, allowing a high-privileged attacker with logon access to the infrastructure to compromise Oracle Solaris. Successful attacks require human...

PT-2025-16348

Name of the Vulnerable Software and Affected Versions Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 version 1.0.15 Description A command injection issue was discovered in the Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3, specifically via partition in the...