9345 matches found
CVE-2025-10299 WPBifröst – Instant Passwordless Temporary Login Links <= 1.0.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
The WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ctlcreatelink AJAX action in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with...
EUVD-2025-34558
The WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ctlcreatelink AJAX action in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with...
AZL-68522 CVE-2025-39982 affecting package kernel for versions less than 6.6.112.1-1
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Fix UAF in hciaclcreateconnsync This fixes the following UFA in hciaclcreateconnsync where a connection still pending is command submission conn-state == BTOPEN maybe freed, also since this also can happen wi...
UBUNTU-CVE-2025-39982
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Fix UAF in hciaclcreateconnsync This fixes the following UFA in hciaclcreateconnsync where a connection still pending is command submission conn-state == BTOPEN maybe freed, also since this also can happen wi...
CVE-2025-39982 Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Fix UAF in hciaclcreateconnsync This fixes the following UFA in hciaclcreateconnsync where a connection still pending is command submission conn-state == BTOPEN maybe freed, also since this also can happen wi...
CVE-2025-39982
CVE-2025-39982: Linux kernel Bluetooth subsystem use-after-free in hci_acl_create_conn_sync (and related paths like hci_le_create_conn_sync) has been fixed. The issue occurred when a connection in BT_OPEN state pending command submission could be freed, leading to a use-after-free on the connecti...
CVE-2025-10299: Missing Authorization
The WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ctlcreatelink AJAX action in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with...
PT-2025-42311
Name of the Vulnerable Software and Affected Versions WordPress Zip Attachments plugin versions up to and including 1.6 Description The Zip Attachments plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check and a lack of post status...
Linux Kernel Security Vulnerabilities
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that originates from a post-release reuse issue in hciaclcreateconnsync and hcilecreateconnsync, which could lead to memory...
PT-2025-42257
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.16.0-rc7 Description The Linux kernel contains a use-after-free issue within the Bluetooth stack, specifically in the hci acl create conn sync function. This flaw occurs when a connection is pending command...
CVE-2025-59836
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, there is a nil pointer dereference vulnerability in the Omni Resource Service allows unauthenticated users to cause a server panic and denial of service by sending empty create/update resource reques...
PT-2025-42292
Name of the Vulnerable Software and Affected Versions WPBifröst versions through 1.0.7 Description The WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress has an issue that allows authenticated attackers with Subscriber-level access or higher to create new administrative...
Linux Distros Unpatched Vulnerability : CVE-2022-50525
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/fslpamu: Fix resource leak in fslpamuprobe The fslpamuprobe returns directly when createcsd failed, leaving irq and memories unreleased. Fix by jumping to...
CVE-2025-59836
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, there is a nil pointer dereference vulnerability in the Omni Resource Service allows unauthenticated users to cause a server panic and denial of service by sending empty create/update resource reques...
CVE-2025-59836 Omni is Vulnerable to DoS via Empty Create/Update Resource Requests
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, there is a nil pointer dereference vulnerability in the Omni Resource Service allows unauthenticated users to cause a server panic and denial of service by sending empty create/update resource reques...
EUVD-2025-34081
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, there is a nil pointer dereference vulnerability in the Omni Resource Service allows unauthenticated users to cause a server panic and denial of service by sending empty create/update resource reques...
CVE-2025-59836 Omni is Vulnerable to DoS via Empty Create/Update Resource Requests
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, there is a nil pointer dereference vulnerability in the Omni Resource Service allows unauthenticated users to cause a server panic and denial of service by sending empty create/update resource reques...
NULL Pointer Dereference
Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via the isSensitiveSpec function which calls grpcomni.CreateResource without checking if the resource's metadata field is nil. An attacker can cause a server crash and disrupt service availability by sending emp...
Arbitrary File Write
github.com/usememos/memos is vulnerable to arbitrary file write. The vulnerability is due to improper validation of file paths in the CreateResource endpoint when storing objects locally, which allows an attacker to create files with path traversal sequences and write arbitrary files on the serve...
EUVD-2025-33927
A security vulnerability has been detected in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This impacts an unknown function of the file /assets/createNotice.php. The manipulation of the argument File leads to unrestricted upload. The attack may be...