Hitachi Energy Relion 670/650 and SAM600-IO Series (Update A)

SUMMARY Hitachi Energy is aware of a vulnerability that affects the Relion 670/650 and SAM600-IO series IED device versions that are listed in this document. An authenticated attacker successfully exploiting this vulnerability via FTP access can cause the device to reboot due to improper disk...

CVE-2025-53073

In Sentry 25.1.0 through 25.5.1, an authenticated attacker can access a project's issue endpoint and perform unauthorized actions such as adding a comment without being a member of the project's team. A seven-digit issue ID must be known it is not treated as a secret and might be mentioned...

CVE-2025-53073

In Sentry 25.1.0 through 25.5.1, an authenticated attacker can access a project's issue endpoint and perform unauthorized actions such as adding a comment without being a member of the project's team. A seven-digit issue ID must be known it is not treated as a secret and might be mentioned...

Improper Access Control in Socket.IO Event Handlers Allows Unauthenticated Execution of Sensitive Actions

1. Summary Vulnerability: Unauthenticated Access to Sensitive Socket.IO Events Affected Component: lollmsgenerationevents.py in the lollms server Root Cause: Sensitive actions exposed via Socket.IO events lack authentication and authorization checks, and the application relies on insecure global...

A Fast, Reliable, and Secure Programming Language for LLM Agents with Code Actions

Modern large language models LLMs are often deployed as agents, calling external tools adaptively to solve tasks. Rather than directly calling tools, it can be more effective for LLMs to write code to perform the tool calls, enabling them to automatically generate complex control flow such as...

CVE-2025-38045

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix debug actions order The order of actions taken for debug was implemented incorrectly. Now we implemented the dump split and do the FW reset only in the middle of the dump rather than the FW killing itself on...

WordPress plugin Change Cart button Colors WooCommerce 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in the WordPress Change Cart button Colors WooCommerce plugin, which arises from a web application that does not adequately...

PT-2025-26389 · Unknown · Mailing Group Listserv

Name of the Vulnerable Software and Affected Versions: Yamna Khawaja Mailing Group Listserv versions 3.0.5 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Mailing Group Listserv, allowing unauthorized actions to be performed on behalf of the user. Recommendations: For...

PT-2025-26340 · Unknown · Tm Replace Howdy

Name of the Vulnerable Software and Affected Versions: TM Replace Howdy versions 1.4.2 and earlier Description: A Cross-Site Request Forgery CSRF issue allows unauthorized actions to be performed on behalf of a user. This issue affects the TM Replace Howdy plugin, enabling Cross Site Request...

PT-2025-26345 · WordPress · Wp Inventory Manager

Name of the Vulnerable Software and Affected Versions: WP Inventory Manager versions prior to 2.3.4 Description: A Cross-Site Request Forgery CSRF issue affects the WP Inventory Manager, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions prior to 2.3....

WordPress plugin ClipLink 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in the WordPress ClipLink plugin, which arises from a web application that does not adequately validate that a request is comin...

The vulnerability in the Web browser Epiphany, related to the lack of user alerts about unsafe actions, allows a hacker to execute arbitrary code.

The vulnerability in the Web browser Epiphany is related to the lack of user alerts about unsafe actions. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2025-26395 · Unknown · Rameez Iqbal Real Estate Manager

Name of the Vulnerable Software and Affected Versions: Rameez Iqbal Real Estate Manager versions n/a through 7.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on the affected system. This is a type of attack whe...

PT-2025-26335 · Unknown · Live Sports Streamthunder

Name of the Vulnerable Software and Affected Versions: Live Sports Streamthunder versions n/a through 2.1 Description: A Cross-Site Request Forgery CSRF issue allows unauthorized actions to be performed on behalf of a user. This issue affects the Live Sports Streamthunder software. Recommendation...

SUSE CVE-2025-6018

A Local Privilege Escalation LPE vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules PAM. This flaw allows an unprivileged local attacker for example, a user logged in via SSH to obtain the elevated privileges normally reserved for a physically present,...

SUSE CVE-2025-38045

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix debug actions order The order of actions taken for debug was implemented incorrectly. Now we implemented the dump split and do the FW reset only in the middle of the dump rather than the FW killing itself on...

CVE-2024-54172

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2024-54172 IBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site request forgery

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2025-38045

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix debug actions order The order of actions taken for debug was implemented incorrectly. Now we implemented the dump split and do the FW reset only in the middle of the dump rather than the FW killing itself on...

AZL-70286 CVE-2025-38045 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix debug actions order The order of actions taken for debug was implemented incorrectly. Now we implemented the dump split and do the FW reset only in the middle of the dump rather than the FW killing itself on...