CVE-2025-68265

CVE-2025-68265: Linux kernel vulnerability fixed in nvme: fix admin request_queue lifetime. The issue allowed namespaces to access a controller’s admin request_queue and could leave stale references after tearing down the controller, risking a use-after-free (KASAN) in blk_queue_enter. The patch ...

CVE-2025-68265 nvme: fix admin request_queue lifetime

In the Linux kernel, the following vulnerability has been resolved: nvme: fix admin requestqueue lifetime The namespaces can access the controller's admin requestqueue, and stale references on the namespaces may exist after tearing down the controller. Ensure the admin requestqueue is active by...

CVE-2025-68265 nvme: fix admin request_queue lifetime

In the Linux kernel, the following vulnerability has been resolved: nvme: fix admin requestqueue lifetime The namespaces can access the controller's admin requestqueue, and stale references on the namespaces may exist after tearing down the controller. Ensure the admin requestqueue is active by...

Portworx Half-Blind SSRF in kube-controller-manager

...

PT-2025-51678

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.13.2-ga1582f1a031e Description The Linux kernel had a flaw related to the admin request queue lifetime in the NVMe subsystem. Namespaces could access the controller's admin request queue, and stale references...

Cisco IMC vKVM Redirection

The vulnerability of the Virtual Keyboard Video Monitor vKVM system, a remote administration tool from Cisco’s Integrated Management Controller IMC, involves redirecting URLs to an unreliable website. Exploiting this vulnerability allows a malicious actor to redirect users to any given URL addres...

PT-2025-51708

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Bluetooth implementation within the Linux kernel, specifically in the hci core component. The issue relates to improper locking mechanisms when handling Bluetooth...

PT-2025-51691

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to a race condition within the dwc3 remove requests function. This occurs due to unsynchronized execution of multiple call paths, potentially...

Linux Keyboard Driver Heap Buffer Overflow DoS

The vulnerability in the drivers/input/keyboard/croseckeyb.c file of the keyboard driver for the ChromeOS embedded controller EC in the Linux operating system is related to incorrect initialization of resources. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2025-54736

Half-blind Server Side Request Forgery in kube-controller-manager through in-tree Portworx StorageClass in k8s.io/kubernetes...

CVE-2025-14722

A vulnerability was determined in vion707 DMadmin up to 3403cafdb42537a648c30bf8cbc8148ec60437d1. This impacts the function Add of the file Admin/Controller/AddonsController.class.php of the component Backend. Executing manipulation can lead to cross site scripting. The attack can be executed...

CVE-2025-14722 vion707 DMadmin Backend AddonsController.class.php add cross site scripting

A vulnerability was determined in vion707 DMadmin up to 3403cafdb42537a648c30bf8cbc8148ec60437d1. This impacts the function Add of the file Admin/Controller/AddonsController.class.php of the component Backend. Executing manipulation can lead to cross site scripting. The attack can be executed...

CVE-2025-14722

CVE-2025-14722 affects vion707 DMadmin (Backend) with a Cross-Site Scripting vulnerability in the Add function of Admin/Controller/AddonsController.class.php. A remote attacker can manipulate input to trigger XSS; exploits have been publicly disclosed. Affected versions are prior to 3403cafdb4253...

CVE-2025-14722 vion707 DMadmin Backend AddonsController.class.php add cross site scripting

A vulnerability was determined in vion707 DMadmin up to 3403cafdb42537a648c30bf8cbc8148ec60437d1. This impacts the function Add of the file Admin/Controller/AddonsController.class.php of the component Backend. Executing manipulation can lead to cross site scripting. The attack can be executed...

CVE-2025-13281

A half-blind Server-Side Request Forgery SSRF found in kube-controller-manager that can be triggered when using the legacy in-tree Portworx StorageClass. An authorized user with sufficient privileges can cause the controller to make requests to internal, host-network–accessible endpoints,...

CVE-2025-13824

A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with solid red Fault LED and becomes unresponsive. Upon power cycle, the controller will enter recoverable fault where the MS LED and Fault LED become flashing red and...

openwisp-controller (>=0.2.0, <=0.3.1), openwisp-network-topology (>=0.1.0a0, <=0.2.2) +2 more potentially affected by CVE-2025-65430 via django-allauth (0.38.0)

django-allauth PYPI version 0.38.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - openwisp-controller =0.2.0, =0.1.0a0, =0.1.11, =0.1.0a0, =0.1.0 Source cves: CVE-2025-65430 Source advisory: OSV:GHSA-QHMC-3MVR-F2J...

openwisp-controller (>=0.2.0, <=0.3.1), openwisp-network-topology (>=0.1.0a0, <=0.2.2) +2 more potentially affected by CVE-2025-65431 via django-allauth (0.38.0)

django-allauth PYPI version 0.38.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - openwisp-controller =0.2.0, =0.1.0a0, =0.1.11, =0.1.0a0, =0.1.0 Source cves: CVE-2025-65431 Source advisory: OSV:GHSA-8M3C-C723-H4P...

openwisp-controller (>=0.2.0, <=0.3.1), openwisp-network-topology (>=0.1.0a0, <=0.2.2) +2 more potentially affected by CVE-2025-65431 via django-allauth (0.38.0)

django-allauth PYPI version 0.38.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - openwisp-controller =0.2.0, =0.1.0a0, =0.1.11, =0.1.0a0, =0.1.0 Source cves: CVE-2025-65431 Source advisory: OSV:PYSEC-2025-111...

kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass

A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...