CVE-2025-6020

A flaw was found in linux-pam. The module pamnamespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions...

📄 EMQX 5.8.5 Remote Code Execution

A remote code execution vulnerability exists in the EMQX Dashboard component of EMQX, up to and including version 5.8.5. Authenticated users can upload plugins containing arbitrary code, including any kind of Erlang code, which may be executed on the server hosting the web interface. This is...

The vulnerabilities of the macros CacheMacroRequiredRightsAnalyzer.java, ContentMacroRequiredRightsAnalyzer.java, DefaultMacroBlockRequiredRightAnalyzer.java, and ContextMacroRequiredRightsAnalyzer.java in the XWiki Platform for creating collaborative web applications allow a perpetrator to execute arbitrary code.

The vulnerabilities of the macros CacheMacroRequiredRightsAnalyzer.java, ContentMacroRequiredRightsAnalyzer.java, DefaultMacroBlockRequiredRightAnalyzer.java, and ContextMacroRequiredRightsAnalyzer.java in the XWiki Platform for creating collaborative web applications are related to the absence o...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: ipv6: Use RCU protection in ip6defaultadvmss. ip6defaultadvmss requires RCU protection to ensure that the network structure it reads does not disappear...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: fs/9p: Fixed the issue of NULL pointer dereferencing when using mkdir. When a 9p tree was mounted with the posixacl option, the parent directory had a default ACL set for its subdirectories. For example: setfacl -m...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: nfsd: Clearing aclaccess/acldefault after releasing them If the attempt to get acldefault fails, aclaccess and acldefault will be released simultaneously. However, aclaccess will still retain a pointer pointing to the released...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: drm/vkms: Fixed issues related to use after free and double-free operations during initialization. If the driver initialization fails, the vkmsexit function may access an uninitialized or freed defaultconfig pointer, potential...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: zoned: return EIO on RAID1 block group write pointer mismatch There was a bug report regarding a NULL pointer dereference in btrfsaddfreespacezoned, which occurs due to a conversion from the default metadata profile DUP...

Astra Linux – Vulnerability in curl

When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could potentially expose the password used for the first host to the followed-to host under certain circumstances. This flaw only occurs if the netrc file contains a default entry that omits both the login...

📄 AirKeyboard 1.9.0.0 Integer Overflow / Denial of Service

AirKeyboard version 1.9.0.0 suffers from an integer overflow vulnerability in its TCP request handler. The ReadLength method parses a 4-byte user-supplied length field without bounds checking, allowing attackers to trigger a denial-of-service by sending a malformed packet with an oversized length...

TencentOS Server 3: crun (TSSA-2022:0278)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2022:0278 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

CVE-2025-5484

A username and password are required to authenticate to the central SinoTrack device management interface. The username for all devices is an identifier printed on the receiver. The default password is well-known and common to all devices. Modification of the default password is not enforced duri...

GHSA-9875-CW22-F7CX XWiki allows remote code execution through default value of wiki macro wiki-type parameters

Impact Any user with edit right on a page could be the user's profile can execute code Groovy, Python, Velocity with programming right by defining a wiki macro. This allows full access to the whole XWiki installation and thus impacts its confidentiality, integrity and availability. The main probl...

CVE-2025-49581

XWiki is a generic wiki platform. Any user with edit right on a page could be the user's profile can execute code Groovy, Python, Velocity with programming right by defining a wiki macro. This allows full access to the whole XWiki installation. The main problem is that if a wiki macro parameter...

CVE-2025-49581 XWiki allows remote code execution through default value of wiki macro wiki-type parameters

XWiki is a generic wiki platform. Any user with edit right on a page could be the user's profile can execute code Groovy, Python, Velocity with programming right by defining a wiki macro. This allows full access to the whole XWiki installation. The main problem is that if a wiki macro parameter...

CVE-2025-22241

File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization file” at a specific location a...

CVE-2025-22241

CVE-2025-22241 affects Salt's VirtKey class; the vulnerability arises from on-demand pillar data paths derived from unvalidated input to the pki directory, enabling auto-accept of Minion authentication keys via a pre-placed authorization file in the default config. Public disclosures in SUSE/open...

The vulnerability of the Ivanti Cloud Services Application’s network component, related to the use of default credentials, allows a hacker to escalate their privileges.

The vulnerability of the Ivanti Cloud Services Application’s network component is related to the use of default credentials. Exploiting this vulnerability could allow an attacker to gain increased privileges...

CVE-2025-5484

A username and password are required to authenticate to the central SinoTrack device management interface. The username for all devices is an identifier printed on the receiver. The default password is well-known and common to all devices. Modification of the default password is not enforced duri...

CVE-2025-5484 SinoTrack GPS Receiver Weak Authentication

A username and password are required to authenticate to the central SinoTrack device management interface. The username for all devices is an identifier printed on the receiver. The default password is well-known and common to all devices. Modification of the default password is not enforced duri...