CVE-2025-24315

CVE-2025-24315 concerns Growatt Cloud Applications. Several connected sources (CNVD-2025-14962, CNNVD-202504-2316, RH: Red Hat, CVE lists) describe an unauthenticated bystander vulnerability where an attacker can add devices of other users to scenes (or arbitrary scenes) in Growatt Cloud Applicat...

CVE-2025-32945

The vulnerability allows an existing user to add playlists to a different user’s channel using the PeerTube REST API. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the channel ID supplied by the request,...

CVE-2025-32945 PeerTube Arbitrary Playlist Creation via REST API

The vulnerability allows an existing user to add playlists to a different user’s channel using the PeerTube REST API. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the channel ID supplied by the request,...

CVE-2025-32945

PeerTube CVE-2025-32945: A REST API flaw allows an authenticated user to add playlists to another user’s channel. The code creates the playlist with the requester as owner and sets the channel to the supplied ID without verifying ownership, enabling cross-user playlist creation. CVSS v3.1 base sc...

Growatt Cloud Applications 安全漏洞

Growatt Cloud Applications is a monitoring platform from Growatt in China. A security bypass vulnerability exists in Growatt Cloud Applications version 3.6.0 and prior versions, which can be exploited by an unauthenticated attacker to add another user's device to a scenario...

PT-2025-16228 · Softcom · Softcom Iksoris Internet Starter

Name of the Vulnerable Software and Affected Versions: SoftCOM iKSORIS Internet Starter versions prior to 79.0 Description: The issue is related to Reflected XSS Cross-site Scripting attacks. An attacker might trick a user into filling a form designed for adding users with a malicious script, whi...

RuoYi 安全漏洞

RuoYi is a backend management system by the individual developer of RuoYi in China. A security vulnerability exists in RuoYi version v.4.8.0, which stems from the add method not properly verifying the requested user's permissions, which may result in the addition of a menu item...

CVE-2025-21995 drm/sched: Fix fence reference count leak

In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix fence reference count leak The lastscheduled fence leaks when an entity is being killed and adding the cleanup callback fails. Decrement the reference count of prev when dmafenceaddcallback fails, ensuring proper...

CVE-2025-21935

In CVE-2025-21935, the Linux kernel rapidio subsystem fixes a missing check in rio_scan_alloc_net(): the return value of rio_add_net() must be checked, and if it fails, put_device() should be called to free memory and drop the reference from rio_add_net(). This prevents potential memory leaks and...

CVE-2024-56325

Apache Pinot versions prior to 1.3.0 are vulnerable to an authentication bypass issue within the AuthenticationFilter class. The root cause is the insufficient neutralization of special characters in a URI; specifically, if a path does not contain / and contains ., authentication is not required....

maccms10 安全漏洞

maccms10 is magicblack open source a set of PHP + MYSQL environment running under the perfect and powerful rapid website building system. A security vulnerability exists in maccms10 version v2025.1000.4047, which originates from a server-side request forgery in the Add Article feature...

CVE-2023-52942 cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask()

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Fix wrong check in updateparentsubpartscpumask It was found that the check to see if a partition could use up all the cpus from the parent cpuset in updateparentsubpartscpumask was incorrect. As a result, it is...

GHSA-W6FV-6GCC-X825 Zincati allows unprivileged access to rpm-ostree D-Bus `Deploy()` and `FinalizeDeployment()` methods

Impact Zincati ships a polkit rule which allows the zincati system user to use the following actions: - org.projectatomic.rpmostree1.deploy: used to deploy updates to the system - org.projectatomic.rpmostree1.finalize-deployment: used to reboot the system into the deployed update Since Zincati...

CVE-2024-13887

CVE-2024-13887 concerns the WordPress plugin Business Directory Plugin – Easy Listing Directories for WordPress (versions

WordPress Business Directory plugin <= 6.4.14 - Insecure Direct Object Reference to Listing Arbitrary Image Addition vulnerability

Insecure Direct Object Reference to Listing Arbitrary Image Addition vulnerability discovered by Rein Daelman trein in WordPress Plugin Business Directory versions = 6.4.14...

Unbreakable Enterprise kernel security update

5.4.17-2136.341.3.1 - Revert 'NFSD: Limit the number of concurrent async COPY operations' Sherry Yang Orabug: 37667080 5.4.17-2136.341.3 - iouring: fix possible deadlock in ioregisteriowqmaxworkers Hagar Hemdan Orabug: 37565787 - iouring/rw: fix missing NOWAIT check for ODIRECT start write Jens...

DEBIAN-CVE-2024-58071

In the Linux kernel, the following vulnerability has been resolved: team: prevent adding a device which is already a team device lower Prevent adding a device which is already a team device lower, e.g. adding veth0 if vlan1 was already added and veth0 is a lower of vlan1. This is not useful in...

CVE-2024-58076 clk: qcom: gcc-sm6350: Add missing parent_map for two clocks

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-sm6350: Add missing parentmap for two clocks If a clkrcg2 has a parent, it should also have parentmap defined, otherwise we'll get a NULL pointer dereference when calling clksetrate like the following: 3.388105 Cal...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from preventing the addition of devices that are already underneath the TEAM device, potentially leading to...

Vasion Print 访问控制错误漏洞

Vasion Print is a SaaS-based, cloud-hosted application from Vasion for managing and deploying printers. A security vulnerability exists in Vasion Print that stems from allowing unauthenticated addition of some administrator users...