CVE-2025-14541 Lucky Wheel Giveaway <= 1.0.22 - Authenticated (Administrator+) Remote Code Execution via 'conditional_tags' Parameter

The Lucky Wheel Giveaway plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.22 via the conditionaltags parameter. This is due to the plugin using PHP's eval function on user-controlled input without proper validation or sanitization. This makes i...

PT-2026-7553

Name of the Vulnerable Software and Affected Versions File Station 5 versions prior to 5.5.6.5068 Description A path traversal issue exists in File Station 5. A remote attacker with administrator privileges may be able to read the contents of arbitrary files or system data. Recommendations Update...

PT-2026-7566

An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of...

PT-2026-7667

FlexNet Publisher 11.12.1 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without authentication. Attackers can craft a malicious HTML form to trick authenticated users into submitting a request that creates a new local admin accoun...

PT-2026-7571

A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: File...

PT-2026-7573

Name of the Vulnerable Software and Affected Versions QNAP versions prior to QuTS hero h5.3.2.3354 build 20251225 Description A flaw exists where a remote attacker with administrator privileges can trigger a denial-of-service DoS condition through a NULL pointer dereference. Recommendations Updat...

PT-2026-7567

Name of the Vulnerable Software and Affected Versions Qsync Central versions prior to 5.0.0.4 Description A flaw exists in Qsync Central that could allow a remote attacker to cause a denial-of-service DoS condition. Successful exploitation requires the attacker to obtain administrator account...

PT-2026-7561

An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of...

PT-2026-7534

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

CVE-2025-65127

Affects Shenzhen Zhibotong Electronics ZBT WE2001 (version 23.09.27). The web API component lacks session validation, enabling remote unauthenticated access to administrative information-retrieval functions via get_* calls. Attackers can retrieve device configuration data, including plaintext cre...

PT-2026-7560

Name of the Vulnerable Software and Affected Versions Qsync Central versions prior to 5.0.0.4 Description A flaw exists in Qsync Central that allows a remote attacker with administrator privileges to exhaust resources, potentially preventing other systems, applications, or processes from accessin...

PT-2026-7568

Name of the Vulnerable Software and Affected Versions QNAP versions prior to QuTS hero h5.3.2.3354 build 20251225 Description A flaw exists where a remote attacker, having obtained administrator privileges, could trigger a denial-of-service DoS condition through a NULL pointer dereference...

PT-2026-7554

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Statio...

PT-2026-7563

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 5.2.8.3332 build 20251128 QNAP QuTS hero versions prior to h5.2.8.3321 build 20251117 Description A use of uninitialized variable issue exists in QNAP operating systems. A remote attacker gaining administrator access...

CVE-2025-48509

Missing Checks in certain functions related to RMP initialization can allow a local admin privileged attacker to cause misidentification of I/O memory, potentially resulting in a loss of guest memory integrity...

CVE-2025-48509

Missing Checks in certain functions related to RMP initialization can allow a local admin privileged attacker to cause misidentification of I/O memory, potentially resulting in a loss of guest memory integrity...

CVE-2025-29952

Improper Initialization within the AMD Secure Encrypted Virtualization SEV firmware can allow an admin privileged attacker to corrupt RMP covered memory, potentially resulting in loss of guest memory integrity...

UBUNTU-CVE-2025-48509

Missing Checks in certain functions related to RMP initialization can allow a local admin privileged attacker to cause misidentification of I/O memory, potentially resulting in a loss of guest memory integrity...

CVE-2025-48509

Missing Checks in certain functions related to RMP initialization can allow a local admin privileged attacker to cause misidentification of I/O memory, potentially resulting in a loss of guest memory integrity...

CVE-2025-48509

CVE-2025-48509 describes Missing Checks in functions related to Reverse Map Table (RMP) initialization that can let a local admin attacker misidentify I/O memory, potentially affecting guest memory integrity. The primary technical details indicate this affects AMD EPYC/SNP environments and relate...