CVE-2025-40348 slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts

In the Linux kernel, the following vulnerability has been resolved: slab: Avoid race on slab-objexts in allocslabobjexts If two competing threads enter allocslabobjexts and one of them fails to allocate the object extension vector, it might override the valid slab-objexts allocated by the other...

WordPress Fancy Product Designer | WooCommerce WordPress plugin <= 6.4.8 - Unauthenticated Server-Side Request Forgery via Race Condition vulnerability

Unauthenticated Server-Side Request Forgery via Race Condition vulnerability discovered by Muhammad Zeeshan Xib3rR4dAr in WordPress Plugin Fancy Product Designer versions = 6.4.8...

CVE-2025-13231

The Fancy Product Designer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.4.8. This is due to a time-of-check/time-of-use TOCTOU race condition in the 'url' parameter of the fpdcustomuplodfile AJAX action. The plugin validates the URL by...

CVE-2025-13231 Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Server-Side Request Forgery via Race Condition

The Fancy Product Designer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.4.8. This is due to a time-of-check/time-of-use TOCTOU race condition in the 'url' parameter of the fpdcustomuplodfile AJAX action. The plugin validates the URL by...

CVE-2025-13231

The WordPress Fancy Product Designer plugin (WooCommerce) is affected up to version 6.4.8 by a TOCTOU race condition in the fpd_custom_uplod_file AJAX action. The url parameter is validated with getimagesize(), then later fetched with file_get_contents(), enabling unauthenticated SSRF by serving ...

CVE-2025-13439 Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Information Disclosure and PHAR Deserialization via 'url' Parameter

The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in all versions up to, and including, 6.4.8. This is due to insufficient validation of user-supplied input in the 'url' parameter of the 'fpdcustomuplodfile' AJAX action, which flows...

EUVD-2025-203524

The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 6.4.8. This is due to insufficient validation of user-supplied input in the 'url' parameter of the fpdcustomuplodfile AJAX action, which flows directly into the getimagesi...

CVE-2025-61976

CHOCO TEI WATCHER mini IB-MCT001 contains an issue with improper check for unusual or exceptional conditions. If a remote attacker sends a specially crafted request to the Video Download interface, the system may become unresponsive...

[SECURITY] [DLA 4409-1] paramiko security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4409-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès December 16, 2025 https://wiki.debian.org/LTS -...

FreeBSD Security Advisory - FreeBSD-SA-25:11.ipfw

FreeBSD Security Advisory - In some cases, the 'tcp-setmss' handler may free the packet data and throw an error without halting the rule processing engine. A subsequent rule can then allow the traffic after the packet data is gone, resulting in a NULL pointer dereference...

PT-2025-51564

In the Linux kernel, the following vulnerability has been resolved: slab: Avoid race on slab-obj exts in alloc slab obj exts If two competing threads enter alloc slab obj exts and one of them fails to allocate the object extension vector, it might override the valid slab-obj exts allocated by the...

PT-2025-51700

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the interaction between DRM, fbcon, and vga switcheroo components. Specifically, the issue occurs during fbcon setup when switching outputs, potentially leadin...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from a competing condition between timershutdownsync and timer expiration, which could result in WARNON being trigger...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from an insufficient kfdprocessestable check that could lead to a race condition...

PT-2025-51762

Name of the Vulnerable Software and Affected Versions NVIDIA Resiliency Extension for Linux affected versions not specified Description The NVIDIA Resiliency Extension for Linux has an issue in its checkpointing core that allows an attacker to create a race condition. Exploitation could result in...

Security Advisory 0128

Security Advisory 0128 PDF Date: December 16, 2025 Revision | Date | Changes ---|---|--- 1.0 | December 16, 2025 | Initial release The CVE-ID tracking this issue: CVE-2025-8872 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H 6.5 / 10 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N 7....

ROS-20251216-7350

A vulnerability in the isolated container runc tool is associated with a race condition that allows link tracking. Exploitation of the vulnerability could allow an attacker to impact the confidentiality, integrity and availability of protected information...

ROS-20251216-7354

A vulnerability in the isolated container runc tool is associated with a race condition that allows link tracking. Exploitation of the vulnerability could allow an attacker to impact the confidentiality, integrity and availability of protected information...

PT-2025-51773

Name of the Vulnerable Software and Affected Versions filelock versions prior to 3.20.1 Description filelock is a platform-independent file lock for Python. A Time-of-Check-Time-of-Use TOCTOU race condition allows local attackers to corrupt or truncate arbitrary user files through symlink attacks...

PT-2025-51683

HCL DevOps Deploy / HCL Launch is susceptible to a race condition in http-session client-IP binding enforcement which may allow a session to be briefly reused from a new IP address before it is invalidated. This could lead to unauthorized access under certain network conditions...