PT-2025-34443 · Unopim +1 · Unopim +1

Name of the Vulnerable Software and Affected Versions: UnoPim versions 0.3.0 and earlier Description: UnoPim is an open-source Product Information Management PIM system built on the Laravel framework. Users lacking the necessary Delete privilege for products can bypass access controls by submitti...

VulnCheck KEV: CVE-2024-45891

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to deletewlanprofile...

CVE-2025-55737

flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when deleting a comment, there's no validation of the ownership of the comment. Every user can delete an arbitrary comment of another user on every post, by simply intercepting the delete request and changing the commentID. The code...

Cisco Duo Authentication Proxy Information Disclosure Vulnerability

A vulnerability in the debug logging function of Cisco Duo Authentication Proxy could allow an authenticated, high-privileged, remote attacker to view sensitive information in a system log file. This vulnerability is due to insufficient masking of sensitive information before it is written to...

CVE-2025-8289

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the deleteassociatedfiles function. This makes it possible for unauthenticated attackers to inject a PHP Object. This...

Linux Distros Unpatched Vulnerability : CVE-2023-21971

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/J. Supported versions that are affected are 8.0.32 and prior. Difficult to...

SUSE CVE-2025-38587

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in fib6infousesdev fib6infousesdev seems to rely on RCU without an explicit protection. Like the prior fix in rt6nlmsgsize, we need to make sure fib6delroute or fib6addrt2node have not removed the...

CVE-2025-55737 flaskBlog arbitrary comment delete

flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when deleting a comment, there's no validation of the ownership of the comment. Every user can delete an arbitrary comment of another user on every post, by simply intercepting the delete request and changing the commentID. The code...

DEBIAN-CVE-2025-38605

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Pass ab pointer directly to ath12kdptxgetencaptype In ath12kdptxgetencaptype, the arvif parameter is only used to retrieve the ab pointer. In vdev delete sequence the arvif-ar could become NULL and that would trigge...

CVE-2025-38605

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Pass ab pointer directly to ath12kdptxgetencaptype In ath12kdptxgetencaptype, the arvif parameter is only used to retrieve the ab pointer. In vdev delete sequence the arvif-ar could become NULL and that would trigge...

CVE-2025-38615

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: cancle set bad inode after removing name fails The reproducer uses a file0 on a ntfs3 file system with a corrupted ilink. When renaming, the file0's inode is marked as a bad inode because the file name cannot be deleted...

CVE-2025-38605

CVE-2025-38605 affects the Linux kernel’s wifi/ath12k driver. In ath12k_dp_tx_get_encap_type(), arvif may be NULL during vdev delete, risking a kernel panic. The fix passes the valid ab pointer directly from the caller to avoid dereferencing arvif. Affected reference points to ath12k_dp_tx and re...

CVE-2025-38605 wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Pass ab pointer directly to ath12kdptxgetencaptype In ath12kdptxgetencaptype, the arvif parameter is only used to retrieve the ab pointer. In vdev delete sequence the arvif-ar could become NULL and that would trigge...

CVE-2025-38605 wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Pass ab pointer directly to ath12kdptxgetencaptype In ath12kdptxgetencaptype, the arvif parameter is only used to retrieve the ab pointer. In vdev delete sequence the arvif-ar could become NULL and that would trigge...

CVE-2025-38577

CVE-2025-38577 affects the f2fs component of the Linux kernel. A use-after-free in the f2fs inode handling path leads to a KASAN failure observed during inode writeback (f2fs_update_inode/page, f2fs_write_inode) and can trigger a crash when the kernel attempts to delete a list entry in __list_del...

Linux Distros Unpatched Vulnerability : CVE-2022-21305

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are...

Linux Distros Unpatched Vulnerability : CVE-2025-3580

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. Thi...

CVE-2025-55587

TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the hostname parameter at /boafrm/formMapDelDevice. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

BIT-GITLAB-2024-12303 Incorrect Privilege Assignment in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain conditions could have allowed authenticated users with specific roles and permissions to delete issues including confidential ones by inviting...

PT-2025-33687 · Totolink · Totolink A3002Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002R version 4.0.0-B20230531.1404 Description: A buffer overflow exists in the hostname parameter at the /boafrm/formMapDelDevice API endpoint of the TOTOLINK A3002R router. This issue allows attackers to cause a Denial of Service...