PT-2025-46620

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A flaw exists in the Linux kernel's PCI/pwrctrl subsystem related to double cleanup operations during failure of the devm add action or reset function. Specifically, the code incorrectly...

Cherry Studio 操作系统命令注入漏洞

Cherry Studio is a multi-model AI assistant from China Thousand Comets Cherry Studio. An operating system command injection vulnerability exists in Cherry Studio version 1.5.1, which stems from a streamableHttp MCP server connection that does not properly clean up the URL, which could lead to...

CVE-2025-38500

In the Linux kernel, the following vulnerability has been resolved: xfrm: interface: fix use-after-free after changing collectmd xfrm interface collectmd property on xfrm interfaces can only be set on device creation, thus xfrmichangelink should fail when called on such interfaces. The check to...

WordPress Exclusive Addons For Elementor Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress Exclusive Addons For Elementor, which stems from insufficient input cleanup and escaping, and can be exploited by a...

WordPress Element Pack Elementor Addons and Templates Cross-Site Scripting Vulnerability

WordPress Element Pack Elementor Addons and Templates is a powerful plugin for Elementor designed to simplify website design. A cross-site scripting vulnerability exists in WordPress Element Pack Elementor Addons and Templates, which stems from insufficient input cleanup and output escaping of th...

WordPress Gutenverse Cross-Site Scripting Vulnerability

WordPress Gutenverse is a WordPress plugin designed for the Gutenberg editor to provide rich site building functionality. WordPress Gutenverse suffers from a cross-site scripting vulnerability that stems from insufficient input cleanup and escaping, which can be exploited by an attacker to inject...

Linux Distros Unpatched Vulnerability : CVE-2025-38032

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: mr: consolidate the ipmrcanfreetable checks. Guoyu Yin reported a splat in the ipmr netns...

Linux Distros Unpatched Vulnerability : CVE-2025-37908

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: mm, slab: clean up slab-objexts always When memory allocation profiling is disabled at runti...

Linux Distros Unpatched Vulnerability : CVE-2022-50053

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iavf: Fix reset error handling Do not call iavfclose in iavfresettask error handling. Doing so can lead to double call of napidisable, which can lead to deadloc...

Linux Distros Unpatched Vulnerability : CVE-2022-50146

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PCI: dwc: Deallocate EPC memory on dwpcieepinit errors If dwpcieepinit fails to perform any action after the EPC memory is initialized and the MSI memory region...

Linux Distros Unpatched Vulnerability : CVE-2022-50172

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mt76: mt76x02u: fix possible memory leak in mt76x02umcusendmsg Free the skb if mt76ubulkmsg fails in mt76x02umcusendmsg routine. CVE-2022-50172 Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2022-48776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: mtd: parsers: qcom: Fix missing free for pparts in cleanup Mtdpart doesn't free pparts when ...

WordPress WPBakery Page Builder Cross-Site Scripting Vulnerability

WordPress WPBakery Page Builder is a visual page builder plugin for the WordPress platform that enables complex layout design through a drag-and-drop interface to create responsive web pages without writing code. WordPress WPBakery Page Builder suffers from a cross-site scripting vulnerability th...

WordPress FileBird SQL Injection Vulnerability

WordPress FileBird is a media library management plugin designed for WordPress to help users efficiently organize and manage their media files by providing features such as an intuitive folder system, drag-and-drop operation, search function and batch upload. WordPress FileBird suffers from a SQL...

Siemens多款产品 代码问题漏洞

Siemens SIMATIC STEP and others are products of Siemens, a German company. siemens SIMATIC STEP is a comprehensive engineering tool for configuring and programming SIMATIC controllers. siemens SIMATIC PCS neo is a distributed control system. siemens SIMATIC STEP 7 is a PLC program simulation...

WordPress esri-map-view cross-site scripting vulnerability

WordPress esri-map-view is used to embed Esri/ArcGIS maps or scenes in websites. The plugin realizes map display through short code, supports selecting base map, setting initial view angle, adding custom layers, pop-up information window and other functions, and can embed preconfigured web maps o...

WordPress Flex Guten Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress plugin Flex Guten, which stems from insufficient input cleanup and escaping, and can be exploited by an attacke...

Linux Distros Unpatched Vulnerability : CVE-2025-38419

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Cleanup acquired resources when rprochandleresources fails in rprocattach...

BIT-LIBPHP-2020-7062 Null Pointer Dereference in PHP Session Upload Progress

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.uploadprogress.cleanup is set to 0 disabled, and the file upload fails, the upload procedure would try to clean up data that does...

kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering

In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: Cancel outstanding rescan work when unregistering It's possible to trigger use-after-free here by: a forcing rescanworkfunc to take a long time and b utilizing a pwrctrl driver that may be unloaded for some reason...