PT-2025-16395 · Nixos · Nixos

Name of the Vulnerable Software and Affected Versions: NixOS versions prior to 24.11 and 25.05 Description: The issue is a local privilege escalation affecting all NixOS users, where a local user can create a program to be executed by root during shutdown when systemd.shutdownRamfs.enable is...

PT-2025-20522

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak issue has been identified in the Linux kernel, specifically in the txgbe probe function. The leak occurs when the txgbe sw init function is called, allocating memory for th...

PT-2025-16380 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version V4.0si V16.03.10.20 Description: The issue concerns a Buffer Overflow in the AdvSetMacMtuWan function via the mac2 variable. Recommendations: For Tenda AC10 version V4.0si V16.03.10.20, as a temporary workaround, consider...

HPESBCR04842 rev.1 - HPE Performance Cluster Manager (HPCM), Remote Authentication Bypass

Potential Security Impact: Remote: Authentication Bypass SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Performance Cluster Manager HPCM 1.12 and earlier - https://support.hpe.com/hpesc/docDisplay?docId=a00146086enus&docLocale=enUS CVSS Scores: | CVE | CVSS Vector | Base Scor...

kernel security update

4.18.0-553.50.110.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

AMD DCE110 HW Sequencer Buffer Overflow DoS

Vulnerability of the dce110disablestream function in the drivers/gpu/drm/amd/display/dc/dce110/dce110hwsequencer.c module – The driver for AMD GPU Direct Rendering Infrastructure in Linux operating systems is vulnerable to uncontrolled resource consumption. Exploiting this vulnerability could all...

PT-2025-18404

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed Description A use-after-free issue was detected in the ext4 insert dentry function due to out-of-bounds access caused by incorrect splitting in do split. This issue can le...

PT-2025-25405 · Blink · Bl-Wr9000 +7

Name of the Vulnerable Software and Affected Versions: Blink routers BL-WR9000 version 2.4.9 Blink routers BL-AC2100 AZ3 version 1.0.4 Blink routers BL-X10 AC8 version 1.0.5 Blink routers BL-LTE300 version 1.2.3 Blink routers BL-F1200 AT1 version 1.0.0 Blink routers BL-X26 AC8 version 1.2.8 Blink...

SurrealDB no JavaScript script function default timeout could facilitate DoS

Through enabling the scripting capability. SurrealDB allows for advanced functions with complicated logic, by allowing embedded functions to be written in JavaScript. These functions are bounded for memory and stack size, but not in time. An attacker could launch a number of long running function...

SUSE CVE-2025-32728

In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding...

PT-2025-16085

Name of the Vulnerable Software and Affected Versions: EventON versions prior to 2.3.2 EventON version 2.3.2 Description: The issue is related to improper control of filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File...

Expected Behavior Violation

Overview Affected versions of this package are vulnerable to Expected Behavior Violation due to the behavior of the DisableForwarding directive in sshd8, which fails to disable X11 forwarding and agent forwarding by default. An attacker can bypass intended security restrictions. Remediation A fix...

PT-2025-20730 · Tenda · Tenda Fh451

Name of the Vulnerable Software and Affected Versions: Tenda FH451 version 1.0.0.9 Description: The issue concerns a remote code execution vulnerability in the formSafeEmailFilter function. This allows for unauthorized execution of code, potentially leading to security breaches. Recommendations:...

crud-query-parser SQL Injection vulnerability

Impact Improper neutralization of the order/sort parameter in the TypeORM adapter, which allows SQL injection. You are impacted by this vulnerability if you are using the TypeORM adapter, ordering is enabled and you have not set-up a property filter. Versions 0.0.1, 0.0.2 and 0.0.3 are affected b...

GHSA-9R25-RP3P-H2W4 crud-query-parser SQL Injection vulnerability

Impact Improper neutralization of the order/sort parameter in the TypeORM adapter, which allows SQL injection. You are impacted by this vulnerability if you are using the TypeORM adapter, ordering is enabled and you have not set-up a property filter. Versions 0.0.1, 0.0.2 and 0.0.3 are affected b...

Vulnerability fixed in FortiSwitch

Fortinet has fixed a vulnerability in the FortiSwitch GUI. The vulnerability with reference CVE-2024-48887, is located in the FortiSwitch GUI, which allows a remote, unauthenticated malicious person to change admin passwords via specially crafted requests. This security issue can lead to...

PT-2025-20360

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null pointer dereference issue was found in the Linux kernel's cpufreq subsystem, specifically in the apple-soc driver. The apple soc cpufreq get rate function does not check if cpufre...

PT-2025-15695 · Ibm · Ibm Security Verify Governance

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Governance version 10.0.2 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

Kibana 8.16.4 and 8.17.2 Security Update (ESA-2025-02)

Kibana Prototype Pollution can lead to code injection ESA-2025-02 Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. Affected Versions: Kibana versions 8.16.1 up to and including 8.16.3, and 8.17.0 up to and including 8.17.1 Solutio...

PT-2025-15360

Name of the Vulnerable Software and Affected Versions: opplus springboot-admin versions up to a2d5310f44fd46780a8686456cf2f9001ab8f024 Description: A critical vulnerability has been found in the function code of the file SysGeneratorController.java. The manipulation of the argument Tables leads t...