SUSE CVE-2025-37949

In the Linux kernel, the following vulnerability has been resolved: xenbus: Use kref to track req lifetime Marek reported seeing a NULL pointer fault in the xenbusthread callstack: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: e030:wakeupcommon+0x4c/0x180 Call Trace:...

SUSE CVE-2025-37984

In the Linux kernel, the following vulnerability has been resolved: crypto: ecdsa - Harden against integer overflows in DIVROUNDUP Herbert notes that DIVROUNDUP may overflow unnecessarily if an ecdsa implementation's -keysize callback returns an unusually large value. Herbert instead suggests for...

ModSecurity -- possible DoS vulnerability

[email protected] reports: ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case in stable released versions: when the payload's content...

TYPO3 Unverified Password Change for Backend Users

Problem The backend user management interface allows password changes without requiring the current password. When an administrator updates their own account or modifies other user accounts via the admin interface, the current password is not requested for verification. This behavior may lower th...

GHSA-3JRG-97F3-RQH9 TYPO3 Unverified Password Change for Backend Users

Problem The backend user management interface allows password changes without requiring the current password. When an administrator updates their own account or modifies other user accounts via the admin interface, the current password is not requested for verification. This behavior may lower th...

UBUNTU-CVE-2025-37984

In the Linux kernel, the following vulnerability has been resolved: crypto: ecdsa - Harden against integer overflows in DIVROUNDUP Herbert notes that DIVROUNDUP may overflow unnecessarily if an ecdsa implementation's -keysize callback returns an unusually large value. Herbert instead suggests for...

DEBIAN-CVE-2025-37949

In the Linux kernel, the following vulnerability has been resolved: xenbus: Use kref to track req lifetime Marek reported seeing a NULL pointer fault in the xenbusthread callstack: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: e030:wakeupcommon+0x4c/0x180 Call Trace:...

WordPress ITSulu <= 1.4.0 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Bonds Patchstack Alliance in WordPress Theme ITSulu versions = 1.4.0...

WordPress Avantage Theme <= 2.4.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Avantage versions = 2.4.9...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a DIVROUNDUP integer overflow that could lead to a computation error...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from failure to re-queue skb on wakeup failure, which could lead to a memory leak...

CVE-2025-39352

Missing Authorization vulnerability in ThemeGoods Grand Restaurant WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Restaurant WordPress: from n/a through 7.0...

CVE-2025-32927

Deserialization of Untrusted Data vulnerability in Chimpstudio FoodBakery allows Object Injection.This issue affects FoodBakery: from n/a through 3.3...

CVE-2025-39395

CVE-2025-39395 affects the WordPress plugin WPAMS (Apartment Management System) versions n/a through 44.0 (17-08-2023). The issue is an SQL Injection due to improper neutralization of specific elements in SQL commands. CVSS 3.1/3.1 vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base score 9.3 (CRIT...

CVE-2025-39412

Missing Authorization vulnerability in Averta Master Slider.This issue affects Master Slider: from n/a through 3.10.8...

CVE-2025-39450 WordPress JetTabs plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetTabs allows DOM-Based XSS.This issue affects JetTabs: from n/a through 2.2.7...

CVE-2025-39398

CVE-2025-39398 is a Missing Authorization vulnerability in the WordPress plugin/theme bundle “Hotel + Bed and Breakfast Booking Calendar Theme | Bellevue” (Bellevuex) affecting versions up to 4.2.2. The vulnerability is categorized as Broken Access Control with a CVSS v3.1 base score of 4.3 (Medi...

CVE-2025-23983

CVE-2025-23983 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress Tijaji theme (versions up to 1.43). The issue stems from improper input neutralization during web page generation, enabling reflected XSS. Affected product: Tijaji (WordPress theme); root cause: insufficient i...

CVE-2025-48269

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Greg Winiarski WPAdverts wpadverts allows DOM-Based XSS.This issue affects WPAdverts: from n/a through = 2.2.3...

CVE-2025-48255 WordPress Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP plugin <= 6.2.4 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-integration allows Cross Site Request Forgery.This issue affects Broadcast Live Video: from n/a through = 6.2.4...