UBUNTU-CVE-2025-37977

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set If dma-coherent property isn't set then descriptors are non-cacheable and the iocc shareability bits should be disabled. Without this UFS can end up in an...

CVE-2025-37977

Technical details for CVE-2025-37977 are not publicly available in the provided connected documents; monitor for updates.

DEBIAN-CVE-2025-37946

In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix duplicate pcidevput in disableslot when PF has child VFs With commit bcb5d6c76903 "s390/pci: introduce lock to synchronize state of zpcidev's" the code to ignore power off of a PF that has child VFs was changed from...

CVE-2025-37946 s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs

In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix duplicate pcidevput in disableslot when PF has child VFs With commit bcb5d6c76903 "s390/pci: introduce lock to synchronize state of zpcidev's" the code to ignore power off of a PF that has child VFs was changed from...

PT-2025-22123 · WordPress · Order Delivery Date

Name of the Vulnerable Software and Affected Versions: Order Delivery Date WordPress plugin versions prior to 12.4.0 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the plugin does not properly sanitise and escape a parameter before outputting it...

Broker VM Platform Cortex XDR Auth Bypass

The vulnerability of the Broker VM platform’s security platform, Cortex XDR, is related to the absence of authentication for a critical function. Exploiting this vulnerability allows a malicious actor to bypass the authentication process and disable certain internal services...

DEBIAN-CVE-2025-46801

Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. if the vulnerability is exploited, an attacker may be able to log in to the system as an arbitrary user, allowing them to read or tamper with data in the database, and/or...

UBUNTU-CVE-2025-46801

Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. if the vulnerability is exploited, an attacker may be able to log in to the system as an arbitrary user, allowing them to read or tamper with data in the database, and/or...

CVE-2025-46801

CVE-2025-46801 affects Pgpool-II (PgPool Global Development Group) and related pgpool2 packages, causing authentication bypass via a primary weakness. Exploitation could allow logging in as arbitrary users, leading to reading/tampering data or disabling the database. Public advisories from IBM an...

PT-2025-22003 · Unknown · Twh Offset Writing

Name of the Vulnerable Software and Affected Versions: twh offset writing versions n/a through 1.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This occurs in the twh offset writing...

PT-2025-21865 · Tenda · Tenda Ac15

Name of the Vulnerable Software and Affected Versions: Tenda A15 versions 15.13.07.09 through 15.13.07.13 Description: A critical issue affects an unknown part of the file /goform/multimodalAdd of the component HTTP POST Request Handler, leading to buffer overflow. The manipulation can be initiat...

PT-2025-21859 · Code Projects · Code-Projects Police Station Management System

Name of the Vulnerable Software and Affected Versions: code-projects Police Station Management System version 1.0 Description: A critical issue was found in the function criminal::display of the file source.cpp of the component Display Record. The manipulation of the argument N leads to buffer...

PT-2025-21759 · Tenda · Tenda Ac7

Name of the Vulnerable Software and Affected Versions: Tenda AC7 version 15.03.06.44 Description: A critical issue was found in the function fromSafeSetMacFilter of the file /goform/setMacFilterCfg. The manipulation of the argument deviceList leads to a stack-based buffer overflow. This issue can...

PT-2025-21407 · WordPress · Nokaut Offers Box

Name of the Vulnerable Software and Affected Versions: Nokaut Offers Box WordPress plugin versions 1.4.0 and earlier Description: The issue concerns the lack of CSRF check when updating settings in the Nokaut Offers Box WordPress plugin. This could allow attackers to make a logged-in admin reset...

CLSA-2025-1747253770 libreoffice: Fix of CVE-2023-1183

CVE-2023-1183: disable script command file dump to prevent arbitrary writes...

GlobalProtect App on macOS: Non Admin User Can Disable the GlobalProtect App

An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ app on macOS devices enables a locally authenticated non administrative user to disable the app even if the GlobalProtect app configuration would not normally permit them to do so. The GlobalProtect app on...

PT-2025-21239 · Jenkins · Jenkins Cadence Vmanager Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Cadence vManager Plugin versions 4.0.1-286.v9e25a 740b a 48 and earlier Description: A cross-site request forgery CSRF issue allows attackers to connect to an attacker-specified URL using an attacker-specified username and password...

CVE-2025-0135: Incorrect Privilege Assignment

An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a locally authenticated non administrative user to disable the app. The GlobalProtect app on Windows, Linux, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected...

CVE-2025-0132: Missing Authentication for Critical Function

A missing authentication vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an unauthenticated user to disable certain internal services on the Broker VM. The attacker must have network access to the Broker VM to exploit this issue...

kernel: pmdomain: imx93-blk-ctrl: correct remove path

A flaw was found in the Linux kernel's i.MX93 power domain driver. An improper loop condition in the device removal routine prevents the loop from terminating. A local attacker could exploit this flaw during device unbinding or removal to trigger a kernel panic, resulting in a Denial of Service D...