CVE-2025-31146: Time-of-check Time-of-use (TOCTOU) Race Condition

Time-of-check time-of-use race condition for some Intel Ethernet Adapter Complete Driver Pack software before version 1.5.1.0 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable...

PT-2025-46286

Name of the Vulnerable Software and Affected Versions Preload Current Images plugin for WordPress versions prior to 1.4 Description The Preload Current Images plugin for WordPress is susceptible to Stored Cross-Site Scripting through the complete parameter within the 'preload progress bar'...

EUVD-2025-50533

Malicious code in completecrayfishz3n npm...

EUVD-2025-50532

Malicious code in completemockingbirdz3n npm...

Malicious code in complete_mockingbird_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b157f7a6d43222019638f19f8317d4a6c76a6a613a14986d9290b200fc1ee429 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-48276

Malicious code in completebobolinkz3n npm...

CVE-2025-12098: Exposure of Sensitive Information to an Unauthorized Actor

The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.8 via the 'enqueuesocialloginscript' function. This makes it possible for unauthenticated attackers to extract...

CVE-2025-12099: Deserialization of Untrusted Data

The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.8 via deserialization of untrusted input in the 'importallcourses' function. This makes it possible for authenticated...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988790)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988790 advisory. In the Linux kernel, the following vulnerability has been resolved: NFC: port100: fix use-after-free in port100sendcomplete Syzbot reported UAF in port100sendcomplet...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988932)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988932 advisory. In the Linux kernel, the following vulnerability has been resolved: net: ieee802154: ca8210: Stop leaking skb's Upon error the ieee802154xmitcomplete helper is not...

CVE-2025-29270: Exposure of Sensitive Information to an Unauthorized Actor

Incorrect access control in the realtime.cgi endpoint of Deep Sea Electronics devices DSE855 v1.1.0 to v1.1.26 allows attackers to gain access to the admin panel and complete control of the device...

CVE-2025-64102 Zitadel allows brute-forcing authentication factors

Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, an attacker can perform an online brute-force attack on OTP, TOTP, and passwords. While Zitadel allows preventing online brute force attacks in scenarios like TOTP, Email OTP, or passwords using a lockout...

SUSE CVE-2025-40026

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't recheck L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instructi...

CVE-2025-11086: Improper Privilege Management

The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.7. This is due to the plugin not properly validating a user's role prior to registering a user via the Social Login addon. Th...

CVE-2025-62475: Uncontrolled Resource Consumption

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems component: Core. The supported version that is affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit. Successful...

PT-2025-42991

Name of the Vulnerable Software and Affected Versions Oracle ZFS Storage Appliance Kit version 8.8 Description An easily exploitable issue exists in the Oracle ZFS Storage Appliance Kit component: Block Storage that allows a high-privileged attacker with network access via HTTP to compromise the...

PT-2025-42946

Name of the Vulnerable Software and Affected Versions Oracle Business Intelligence Enterprise Edition versions 7.6.0.0.0 through 8.2.0.0.0 Description A readily exploitable issue exists in Oracle Business Intelligence Enterprise Edition, specifically within the Analytics Web Administration...

PT-2025-42934

Name of the Vulnerable Software and Affected Versions Oracle Financial Services Analytical Applications Infrastructure versions 8.0.7.9 through 8.0.8.7 Oracle Financial Services Analytical Applications Infrastructure version 8.1.2.5 Description An easily exploitable issue exists in the Oracle...

Ash has authorization bypass when bypass policy condition evaluates to true

Summary Bypass policies incorrectly authorize requests when their condition evaluates to true but their authorization checks fail and no other policies apply. Impact Resources with bypass policies can be accessed without proper authorization when: - Bypass condition evaluates to true - Bypass...

SUSE-SU-2025:03629-1 Security update for gstreamer-plugins-rs

This update for gstreamer-plugins-rs fixes the following issues: Update to version 0.12.11 jscPED-13826: - CVE-2024-32650: Fixed infinite loop in rustls::conn::ConnectionCommon:completeio with proper client input bsc1223219...