CVE-2025-1326: Missing Authorization

The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homeyreservationdel function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from ext4xattrdeleteinode causing a task to hang...

DEBIAN-CVE-2022-49796

In the Linux kernel, the following vulnerability has been resolved: tracing: kprobe: Fix potential null-ptr-deref on tracearray in kprobeeventgentestexit When testgenkprobecmd failed after kprobeeventgencmdend, it will goto delete, which will call kprobeeventdelete and release the corresponding...

UBUNTU-CVE-2022-49796

In the Linux kernel, the following vulnerability has been resolved: tracing: kprobe: Fix potential null-ptr-deref on tracearray in kprobeeventgentestexit When testgenkprobecmd failed after kprobeeventgencmdend, it will goto delete, which will call kprobeeventdelete and release the corresponding...

DEBIAN-CVE-2025-37765

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: prime: fix ttmbodelayeddelete oops Fix an oops in ttmbodelayeddelete which results from dererencing a dangling pointer: Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b7b: 0000 1...

UBUNTU-CVE-2025-37765

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: prime: fix ttmbodelayeddelete oops Fix an oops in ttmbodelayeddelete which results from dererencing a dangling pointer: Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b7b: 0000 1...

CVE-2022-49893 cxl/region: Fix cxl_region leak, cleanup targets at region delete

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix cxlregion leak, cleanup targets at region delete When a region is deleted any targets that have been previously assigned to that region hold references to it. Trigger those references to drop by detaching all...

Broadcom Symantec Endpoint Protection Windows Agent security vulnerabilities

Broadcom Symantec Endpoint Protection Windows Agent is a client component of an endpoint security solution from Broadcom, Inc. A security vulnerability exists in Broadcom Symantec Endpoint Protection Windows Agent versions prior to 119.1.7.8, which stems from an elevation of privilege vulnerabili...

Moodle course_can_delete_section Privilege Bypass

The vulnerability of the coursecandeletesection function in the virtual learning environment Moodle is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow a malicious actor to gain increased privileges...

CVE-2025-24349: Permissive List of Allowed Inputs

A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated lowprivileged attacker to delete the configuration of physical network interfaces via a crafted HTTP request...

CVE-2025-3599: Time-of-check Time-of-use (TOCTOU) Race Condition

Symantec Endpoint Protection Windows Agent, running an ERASER Engine prior to 119.1.7.8, may be susceptible to an Elevation of Privilege vulnerability, which may allow an attacker to delete resources that are normally protected from an application or user...

Hitachi Energy MicroSCADA X SYS600 Path Traversal

The vulnerability of the software for controlling and managing equipment in Hitachi Energy’s MicroSCADA X SYS600 and Pro SYS600 systems lies in improper restrictions on the path name to the restricted-access catalog. Exploiting this vulnerability could allow a malicious actor to gain read, modify...

CVE-2025-3964

A vulnerability, which was classified as problematic, was found in withstars Books-Management-System 1.0. Affected is an unknown function of the file /api/article/del of the component Article Handler. The manipulation leads to cross-site request forgery. It is possible to launch the attack...

CVE-2025-3959

Summary : CVE-2025-3959 affects withstars Books-Management-System 1.0. The issue is a cross-site request forgery (CSRF) in an unknown functionality of the file /reader_delete.html. The vulnerability can be triggered remotely and the exploit has been disclosed publicly. It seems to impact only pro...

Books-Management-System security vulnerabilities

Books-Management-System is a book management system by withstars individual developers. A security vulnerability exists in Books-Management-System version 1.0, which stems from a misbehavior in the file /readerdelete.html that leads to cross-site request forgery...

LockDatabaseSettings Arbitrary File Read Write

The vulnerability of the LockDatabaseSettings method in software for managing and monitoring deleted objects in telemetry and telemechanics systems related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to bypass security...

CVE-2025-46576: Improper Privilege Management

There is a Permission Management and Access Control vulnerability in the GoldenDB database product. Attackers can manipulate requests to bypass privilege restrictions and delete content...

ZTE GoldenDB security vulnerability

ZTE GoldenDB is a financial-grade transactional distributed database from China's ZTE Corporation ZTE. It is used in finance, government and enterprise, telecom and other industries to provide highly available data services. An Access Control Error vulnerability exists in ZTE GoldenDB, which stem...

CVE-2025-23773

Missing Authorization vulnerability in mingocommerce Delete All Posts delele-all allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delete All Posts: from n/a through = 1.1.1...

CVE-2025-3915: Missing Authorization

The Aeropage Sync for Airtable plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'aeropageDeletePost' function in all versions up to, and including, 3.2.0. This makes it possible for authenticated attackers, with Subscriber-level access and...