CVE-2025-13056 A user with elevated privileges can inject XSS in the Administration ACL Menus configuration page

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Centreon Infra Monitoring Administration ACL menu configuration modules allows Stored XSS to users with high privileges. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, fro...

PT-2026-29244

Name of the Vulnerable Software and Affected Versions versions prior to the fix for CVE-2026-24029 Description When the early acl drop or earlyACLDrop in Lua option is disabled, and a DNS over HTTPs frontend is utilizing the nghttp2 provider, the Access Control List ACL check is bypassed. This...

SUSE CVE-2023-54313

In the Linux kernel, the following vulnerability has been resolved: ovl: fix null pointer dereference in ovlgetaclrcu Following process: P1 P2 pathopenat linkpathwalk maylookup inodepermissionrcu ovlpermission aclpermissioncheck checkacl getcachedaclrcu ovlgetinodeacl realinode =...

Unity Linux 20.1070e Security Update: libvirt (UTSA-2025-993323)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993323 advisory. A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicio...

OPENSUSE-SU-2025:20121-1 Security update for redis

This update for redis fixes the following issues: - Updated to 8.2.3 boo1252996 CVE-2025-62507 https://github.com/redis/redis/releases/tag/8.2.3 - Security fixes - CVE-2025-62507 Bug in XACKDEL may lead to stack overflow and potential RCE - Bug fixes - HGETEX: A missing numfields argument when...

EUVD-2023-60491

In the Linux kernel, the following vulnerability has been resolved: ovl: fix null pointer dereference in ovlgetaclrcu Following process: P1 P2 pathopenat linkpathwalk maylookup inodepermissionrcu ovlpermission aclpermissioncheck checkacl getcachedaclrcu ovlgetinodeacl realinode =...

CVE-2023-54313

In the Linux kernel, the following vulnerability has been resolved: ovl: fix null pointer dereference in ovlgetaclrcu Following process: P1 P2 pathopenat linkpathwalk maylookup inodepermissionrcu ovlpermission aclpermissioncheck checkacl getcachedaclrcu ovlgetinodeacl realinode =...

CVE-2023-54313

In the Linux kernel, the following vulnerability has been resolved: ovl: fix null pointer dereference in ovlgetaclrcu Following process: P1 P2 pathopenat linkpathwalk maylookup inodepermissionrcu ovlpermission aclpermissioncheck checkacl getcachedaclrcu ovlgetinodeacl realinode =...

CVE-2023-54313 ovl: fix null pointer dereference in ovl_get_acl_rcu()

In the Linux kernel, the following vulnerability has been resolved: ovl: fix null pointer dereference in ovlgetaclrcu Following process: P1 P2 pathopenat linkpathwalk maylookup inodepermissionrcu ovlpermission aclpermissioncheck checkacl getcachedaclrcu ovlgetinodeacl realinode =...

CVE-2023-54313 ovl: fix null pointer dereference in ovl_get_acl_rcu()

In the Linux kernel, the following vulnerability has been resolved: ovl: fix null pointer dereference in ovlgetaclrcu Following process: P1 P2 pathopenat linkpathwalk maylookup inodepermissionrcu ovlpermission aclpermissioncheck checkacl getcachedaclrcu ovlgetinodeacl realinode =...

CVE-2022-50861

In the Linux kernel, the following vulnerability has been resolved: NFSD: Finish converting the NFSv2 GETACL result encoder The xdrstream conversion inadvertently left some code that set the pagelen of the send buffer. The XDR stream encoders should handle this automatically now. This oversight...

VulnCheck KEV: CVE-2025-49844

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all...

CVE-2025-60079

CVE-2025-60079 affects the WordPress Parallax Section block plugin (versions up to and including 1.0.9). The root cause is Missing Authorization, allowing functionality to be accessed without proper ACL constraints. Impact is described as access to restricted functionality due to broken authentic...

CVE-2025-64634

Missing Authorization vulnerability in ThemeFusion Avada avada allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Avada: from n/a through = 7.13.2...

CVE-2025-12035

An integer overflow condition exists in Bluetooth Host stack, within the btbraclrecv routine a critical path for processing inbound BR/EDR L2CAP traffic...

OESA-2025-2814 libvirt security update

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes. The main package includes the libvirtd server exporting the virtualization support. Security Fixes: A flaw was discovered in libvirt in the XML file processing. More specifically, t...

CVE-2025-66571 UNA CMS 9.0.0-RC1 - 14.0.0-RC4 PHP Object Injection

UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profileid POST parameter is passed to PHP unserialize without proper handling, allowing remote, unauthenticated attackers to inject arbitrary PHP objects and potentially wri...

CVE-2025-66571 UNA CMS 9.0.0-RC1 - 14.0.0-RC4 PHP Object Injection

UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profileid POST parameter is passed to PHP unserialize without proper handling, allowing remote, unauthenticated attackers to inject arbitrary PHP objects and potentially wri...

MongoDB 6.0.x < 6.0.25 / 7.0.x < 7.0.21 / 8.0.x < 8.0.5 / 8.1.0-rc0 (SERVER-51366)

The version of MongoDB installed on the remote host is 6.0 prior to 6.0.25 , 7.0 prior to 7.0.21, 8.0 prior to 8.0.5, and 8.1.0-rc0. It is, therefore, affected by a vulnerability as referenced in the SERVER-51366 advisory. - The MongoDB Windows installation MSI may leave ACLs unset on custom...

CVE-2025-66314

Improper Privilege Management vulnerability in ZTE ElasticNet UME R32 on Linux allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ElasticNet UME R32: ElasticNetUMER32V16.23.20.04...