BIT-PHP-MIN-2021-21703 PHP-FPM memory access in root process leading to privilege escalation

In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the...

PT-2025-2687

Name of the Vulnerable Software and Affected Versions FortiDeceptor versions 6.0.0, 5.3.3 and below, 5.2.1 and below, 5.1.0, 5.0.0 Description The issue is related to improper access control, which may allow an authenticated attacker with no privileges to perform operations on the central...

CVE-2025-22138 Private categories allow suggested edits to be viewed via the queue in @codidact/qpixel

@codidact/qpixel is a Q&A-based community knowledge-sharing software. In affected versions when a category is set to private or limited-visibility within QPixel's admin tools, suggested edits within this category can still be viewed by unprivileged or anonymous users via the suggested edit queue...

CVE-2025-22138 Private categories allow suggested edits to be viewed via the queue in @codidact/qpixel

@codidact/qpixel is a Q&A-based community knowledge-sharing software. In affected versions when a category is set to private or limited-visibility within QPixel's admin tools, suggested edits within this category can still be viewed by unprivileged or anonymous users via the suggested edit queue...

CVE-2025-22138 Private categories allow suggested edits to be viewed via the queue in @codidact/qpixel

@codidact/qpixel is a Q&A-based community knowledge-sharing software. In affected versions when a category is set to private or limited-visibility within QPixel's admin tools, suggested edits within this category can still be viewed by unprivileged or anonymous users via the suggested edit queue...

Imagination GPU Driver 安全漏洞

Imagination GPU Driver is a graphics driver from Imagination. A security vulnerability exists in Imagination GPU Driver that originates from software installed and run as an unprivileged user may make incorrect GPU system calls, causing the platform to destabilize and reboot...

QPixel 信息泄露漏洞

QPixel is a Q&A based community knowledge sharing software open source by Codidact. QPixel suffers from an information disclosure vulnerability that stems from the fact that when a category is set to private or limited visibility, suggested edits within this category can still be viewed by...

Important: kernel

Issue Overview: ntfs3 in the Linux kernel through 6.8.0 allows a physically proximate attacker to read kernel memory by mounting a filesystem e.g., if a Linux distribution is configured to allow unprivileged mounts of removable media and then leveraging local access to trigger an out-of-bounds...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost version 9.11.5 and previous versions 9.11.x. The vulnerability stems from not properly enforcing invite permissions, which allows team administrators to...

PT-2025-27564

Name of the Vulnerable Software and Affected Versions: xen affected versions not specified Description: The issue allows an unprivileged guest to cause a hypervisor crash, resulting in a Denial of Service DoS of the entire host. This is due to incorrect stubs exception handling for flags recovery...

PT-2025-50588

Name of the Vulnerable Software and Affected Versions smb4k versions prior to 4.0.0-1+deb13u1 Description Two issues were identified in smb4k, a KDE desktop utility used for mounting Samba/CIFS network shares. These issues could lead to a local denial of service or local privilege escalation...

PT-2025-50587

Name of the Vulnerable Software and Affected Versions smb4k versions prior to 4.0.0-1+deb13u1 Description Two issues were identified in smb4k, a KDE desktop utility used for mounting Samba/CIFS network shares. These issues could lead to a local denial of service or local privilege escalation...

PT-2025-9046

Name of the Vulnerable Software and Affected Versions Xen affected versions not specified Description The issue is related to a potential deadlock when using VT-d and legacy PCI device pass-through, which can cause a Denial of Service DoS affecting the entire host. This occurs when certain kinds ...

Imagination GPU Driver 安全漏洞

Imagination GPU Driver is a graphics driver from Imagination. A security vulnerability exists in Imagination GPU Driver versions 1.13 RTM through 24.2 RTM2, which originates from software installed and run as an unprivileged user can trigger the GPU kernel driver to write to arbitrary read-only...

Imagination GPU Driver 安全漏洞

Imagination GPU Driver is a graphics driver from Imagination. A security vulnerability exists in Imagination GPU Driver version 24.1 RTM, which originates from software run by an unprivileged user that can trigger a use-after-release kernel exception by executing an incorrect GPU system call...

Imagination GPU Driver 安全漏洞

Imagination GPU Driver is a graphics driver from Imagination. A security vulnerability exists in Imagination GPU Driver version 1.15 RTM, which originates from software run by an unprivileged user that can trigger a use-after-release kernel exception by executing incorrect GPU system calls...

Gogs has an argument Injection in the built-in SSH server

Impact When the built-in SSH server is enabled server STARTSSHSERVER = true, unprivileged user accounts with at least one SSH key can execute arbitrary commands on the Gogs instance with the privileges of the user specified by RUNUSER in the configuration. It allows attackers to access and alter...

GHSA-VM62-9JW3-C8W3 Gogs has an argument Injection in the built-in SSH server

Impact When the built-in SSH server is enabled server STARTSSHSERVER = true, unprivileged user accounts with at least one SSH key can execute arbitrary commands on the Gogs instance with the privileges of the user specified by RUNUSER in the configuration. It allows attackers to access and alter...

Gogs allows argument injection during the previewing of changes

Impact Unprivileged user accounts can write to arbitrary files on the filesystem. We could demonstrate its exploitation to force a re-installation of the instance, granting administrator rights. It allows accessing and altering any user's code hosted on the same instance. Patches Unintended Git...

GHSA-CCQV-43VM-4F3W Gogs allows deletion of internal files

Impact Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUNUSER in the configuration. It allows attackers to access and alter any users' code hosted on the same instance. Patches Deletion of .git files has been prohibit...