PT-2025-2785 · Imagination Technologies · Graphics Ddk

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue allows software installed and run as a non-privileged user to conduct improper GPU system calls, enabling access to out-of-bounds OOB kernel memory. This can potentially lead to...

ChargePoint Home Flex 安全漏洞

ChargePoint Home Flex is a series of electric vehicle charging devices from ChargePoint USA. A security vulnerability exists in ChargePoint Home Flex that stems from a lack of proper authentication before executing a system call using a user-supplied string. An attacker exploiting this...

USN-7244-1 jinja2 vulnerabilities

It was discovered that Jinja2 incorrectly handled certain filenames when compiling template content. An attacker could possibly use this issue to execute arbitrary code. CVE-2024-56201 It was discovered that Jinja2 incorrectly handled string formatting calls. An attacker could possibly use this...

CVE-2024-49354

IBM Concert 1.0.0, 1.0.1, and 1.0.2 is vulnerable to sensitive information disclosure through specially crafted API Calls...

CVE-2024-49354

IBM Concert 1.0.0, 1.0.1, and 1.0.2 is vulnerable to sensitive information disclosure through specially crafted API Calls...

CVE-2024-49354 IBM Concert information disclosure

IBM Concert 1.0.0, 1.0.1, and 1.0.2 is vulnerable to sensitive information disclosure through specially crafted API Calls...

CVE-2024-49354 IBM Concert information disclosure

IBM Concert 1.0.0, 1.0.1, and 1.0.2 is vulnerable to sensitive information disclosure through specially crafted API Calls...

CVE-2024-49354

IBM Concert versions 1.0.0–1.0.2 are affected by a sensitive information disclosure vulnerability exploitable via specially crafted API calls. Root cause is described as exposure due to incompatible policies and insufficient protection of service data. A fix is available: upgrade to IBM Concert 1...

IBM Concert 安全漏洞

IBM Concert is a generative artificial intelligence-driven automated application management and monitoring tool based on the watsonx platform released in May 2024 by IBM. IBM Concert suffers from an information disclosure vulnerability that stems from the disclosure of sensitive information via...

Mattermost Server 10.0.x < 10.3 (MMSA-2024-00400)

The version of Mattermost Server installed on the remote host is prior to 10.3. It is, therefore, affected by a improper access control vulnerability as referenced in the MMSA-2024-00400 advisory due to a failure to accurately reflect missing settings, which allows confusion for admins regarding ...

PT-2025-1912 · WordPress · Passwords Manager

Name of the Vulnerable Software and Affected Versions: Passwords Manager plugin for WordPress versions 1.4.8 and earlier Description: The issue is related to SQL Injection via the $wpdb-prefix value in several AJAX functions due to insufficient escaping on the user supplied parameter and lack of...

grpc: Denial of Service through Data corruption in gRPC-C++

A flaw was found in gRPC. In certain configurations, the data sent by the application may be corrupted before transmission over the network, leaving the recipient with an incorrect set of bytes, which will cause RPC requests to fail. This issue may lead to a denial of service...

jinja2: Jinja has a sandbox breakout through indirect reference to format method

A flaw was found in the Jinja package. In affected versions of Jinja, an oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to...

CVE-2024-57900 ila: serialize calls to nf_register_net_hooks()

In the Linux kernel, the following vulnerability has been resolved: ila: serialize calls to nfregisternethooks syzbot found a race in ilaaddmapping 1 commit 031ae72825ce "ila: call nfunregisternethooks sooner" attempted to fix a similar issue. Looking at the syzbot repro, we have concurrent...

CVE-2025-21607

Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover 0x1 and Identity 0x4, the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall executi...

CVE-2025-21607

The CVE-2025-21607 issue affects the Vyper Pythonic smart contract language compiler when using precompiles EcRecover (0x1) and Identity (0x4); the success flag of those calls isn’t checked, allowing an attacker to allocate gas to cause a precompile to fail while the rest of execution continues, ...

CVE-2025-21607 Success of Certain Precompile Calls not Checked in Vyper

Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover 0x1 and Identity 0x4, the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall executi...

CVE-2025-21607 Success of Certain Precompile Calls not Checked in Vyper

Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover 0x1 and Identity 0x4, the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall executi...

Vyper Does Not Check the Success of Certain Precompile Calls

Summary When the Vyper Compiler uses the precompiles EcRecover 0x1 and Identity 0x4, the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall execution continue. Then the execution result can be...

CVE-2025-0063

SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to an attacker with basic user privileges to gain control over the data in Informix database, leading to complete compromise of confidentiality, integrity and...