AZL-70076 CVE-2025-40195 affecting package kernel for versions less than 6.6.117.1-1

In the Linux kernel, the following vulnerability has been resolved: mount: handle NULL values in mntnsrelease When calling in listmount mntnsrelease may be passed a NULL pointer. Handle that case gracefully...

AZL-70109 CVE-2025-40193 affecting package kernel for versions less than 6.6.117.1-1

In the Linux kernel, the following vulnerability has been resolved: xtensa: simdisk: add input size check in procwritesimdisk A malicious user could pass an arbitrarily bad value to memdupusernul, potentially causing kernel crash. This follows the same pattern as commit ee76746387f6 "netdevsim:...

UBUNTU-CVE-2025-40173

In the Linux kernel, the following vulnerability has been resolved: net/ip6tunnel: Prevent perpetual tunnel growth Similarly to ipv4 tunnel, ipv6 version updates dev-neededheadroom, too. While ipv4 tunnel headroom adjustment growth was limited in commit 5ae1e9922bbd "net: iptunnel: prevent...

CVE-2025-12018

The MembershipWorks – Membership, Events & Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-12018

MembershipWorks – Membership, Events & Directory (WordPress) versions up to and including 6.14 are affected by a stored cross-site scripting vulnerability in admin settings due to inadequate input sanitization and output escaping. Exploitation requires an authenticated attacker with administrator...

WordPress MembershipWorks plugin <= 6.14 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by ZAST.AI - ZAST.AI in WordPress Plugin MembershipWorks versions = 6.14...

Zoom Workplace < 6.5.10 Vulnerability (ZSB-25047)

The version of Zoom Workplace installed on the remote host is prior to 6.5.10. It is, therefore, affected by a vulnerability as referenced in the ZSB-25047 advisory. - Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an unauthenticated user to...

[BSA-126] Security Update for incus

Mathias Gibbens uploaded new packages for incus which fixed the following security problems: CVE ID : CVE-2025-64507 It was discovered that Incus, a system container and virtual machine manager, is prone to a local privilege escalation vulnerability if unprivileged users are allowed access to Inc...

Suricata IDPE 8.0.2

Suricata is a network intrusion detection and prevention engine developed by the Open Information Security Foundation and its supporting vendors. The engine is multi-threaded and has native IPv6 support. It's capable of loading existing Snort rules and signatures and supports the Barnyard and...

PT-2025-46220

PacsOne Server version 6.6.2 prior versions are likely affected contains a directory traversal vulnerability within the web-based DICOM viewer component. Successful exploitation allows a remote unauthenticated attacker to read arbitrary files via the 'nocache.php' endpoint with a crafted 'path'...

Important: oci-add-hooks

Issue Overview: net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed withi...

EUVD-2025-38359

The Course Booking System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in the csv-export.php file in all versions up to, and including, 6.1.5. This makes it possible for unauthenticated attackers to directly access the file and obtain an expo...

CVE-2025-12042

The CVE-2025-12042 vulnerability affects the WordPress Course Booking System plugin, specifically due to a missing capability check in csv-export.php. This flaw allows unauthenticated access to export (download) all booking data for all versions up to and including 6.1.5. Public details consisten...

CVE-2025-12860

Summary: CVE-2025-12860 affects DedeBIZ up to version 6.3.2. An SQL injection can be triggered by manipulating the orderby parameter in /admin/freelist_main.php. The vulnerability is exploitable remotely and the public exploit is available. Multiple connected sources corroborate the issue and its...

RHEL 8 : redis:6 (RHSA-2025:19399)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19399 advisory. Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, set...

CVE-2025-62040 WordPress YOP Poll plugin <= 6.5.37 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in YOP YOP Poll yop-poll.This issue affects YOP Poll: from n/a through = 6.5.37...

EUVD-2025-38031

Improper Control of Generation of Code 'Code Injection' vulnerability in Widgetlogic.org Widget Logic widget-logic allows Code Injection.This issue affects Widget Logic: from n/a through = 6.0.5...

BIT-GOLANG-2025-47912 Insufficient validation of bracketed IPv6 hostnames in net/url

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://::1/". IPv4 addresses and hostnames mus...

WordPress The Events Calendar plugin <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure vulnerability

Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure vulnerability discovered by mikemyers in WordPress Plugin The Events Calendar versions = 6.15.9...

Cisco Nexus 3000 9000 Series Switches Protocol Independent Multicast Version 6 DoS (cisco-sa-nxospc-pim6-vG4jFPh)

According to its self-reported version, Cisco NX-OS Software is affected by a vulnerability. - A vulnerability in the Protocol Independent Multicast Version 6 PIM6 feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticate...