CVE-2025-12265

A weakness has been identified in Tenda CH22 1.0.0.1. Affected by this issue is the function fromVirtualSer of the file /goform/VirtualSer. This manipulation of the argument page causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the publ...

CVE-2025-12265

A weakness has been identified in Tenda CH22 1.0.0.1. Affected by this issue is the function fromVirtualSer of the file /goform/VirtualSer. This manipulation of the argument page causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the publ...

CVE-2025-12265

A weakness has been identified in Tenda CH22 1.0.0.1. Affected by this issue is the function fromVirtualSer of the file /goform/VirtualSer. This manipulation of the argument page causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the publ...

CVE-2025-41009: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the DRED virtual campus platform. This vulnerability allows an attacker to retrieve, create, update, and delete data from the database by sending a POST request using the ‘buscame’ parameter in ‘/catalogoc/catalogo.php’...

Important: qemu

Issue Overview: A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client wi...

Tenda CH22 security vulnerabilities

Tenda CH22 is a network device from Tenda, China. Tenda CH22 version 1.0.0.1 suffers from a buffer overflow vulnerability, which originates from the parameter page of the function fromVirtualSer in the file /goform/VirtualSer that fails to correctly validate the length of the input data, and can ...

Design of Educational Resources – SQL Injection Vulnerability in Virtual Campus Platform

Diseño de Recursos Educativos Virtual Campus Platform is a virtual classroom platform from Diseño de Recursos Educativos, Spain. Diseño de Recursos Educativos Virtual Campus Platform suffers from a SQL injection vulnerability that stems from incorrect manipulation of the parameter buscame in the...

CVE-2025-61101

FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the showvtyextlinkrmtitfaddr function at ospfext.c. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted OSPF packet...

Siemens SIMATIC Devices Improper Handling of Structural Elements (CVE-2024-35877)

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: fix VMPAT handling in COW mappings PAT handling won't do the right thing in COW mappings: the first PTE or, in fact, all PTEs can be replaced during write faults to point at anon folios. Reliably recovering the correc...

Linux Distros Unpatched Vulnerability : CVE-2025-39968

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i40e: add max boundary check for VF filters There is no check for max filters that VF can request. Add it. CVE-2025-39968 Note that Nessus relies on the presenc...

Exploit for CVE-2025-62376

Improper Authentication in pwn.college DOJO Education Platform...

ice: Fix memory corruption in VF driver

...

vhost: Take a reference on the task in struct vhost_task.

...

ipvs: Defer ip_vs_ftp unregister during netns cleanup

...

WordPress WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin <= 8.5.41 - Improper Authorization to Authenticated (Contributor+) Plugin Settings Update vulnerability

Improper Authorization to Authenticated Contributor+ Plugin Settings Update vulnerability discovered by Rafshanzani Suhada in WordPress Plugin WP VR versions = 8.5.41...

CVE-2025-12005: Improper Authorization

The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 8.5.41. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

SUSE CVE-2025-40023

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Don't expose sysfs attributes not applicable for VFs VFs can't read BMGPCIECAP0x138340 register nor access PCODE already guarded by the info.skippcode flag so we shouldn't expose attributes that require any of them to...

SUSE CVE-2025-58149

When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have. As a result a domain can still have access any 64bit memory BAR when such device is no longer assigned to the domain. For PV domains the permission leak allo...

DEBIAN-CVE-2025-40023

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Don't expose sysfs attributes not applicable for VFs VFs can't read BMGPCIECAP0x138340 register nor access PCODE already guarded by the info.skippcode flag so we shouldn't expose attributes that require any of them to...

CVE-2025-40023

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Don't expose sysfs attributes not applicable for VFs VFs can't read BMGPCIECAP0x138340 register nor access PCODE already guarded by the info.skippcode flag so we shouldn't expose attributes that require any of them to...