PT-2025-7597 · Libming · Libming

Name of the Vulnerable Software and Affected Versions: libming version 0.4.8 Description: A memory leak has been identified in the readSizedString function in util/read.c, which allows attackers to cause a denial of service via a crafted file. Recommendations: For libming version 0.4.8, consider...

PT-2025-7563 · Tenda · Tenda Ac8V4

Name of the Vulnerable Software and Affected Versions: Tenda AC8V4 version 16.03.34.06 Description: A stack overflow issue was discovered in the sub 49E098 function through the shareSpeed parameter. This issue allows for potential exploitation. No information is available regarding the estimated...

PT-2025-7601 · Libming · Libming

Name of the Vulnerable Software and Affected Versions: libming version 0.4.8 Description: Multiple memory leaks have been identified in the ABC file parsing functions, specifically in parseABC CONSTANT POOL and parseABC FILE, which allow attackers to cause a denial of service via a crafted ABC...

PT-2025-7300 · Phpjabbers · Phpjabbers Restaurant Booking System

Name of the Vulnerable Software and Affected Versions: PHPJabbers Restaurant Booking System version 3.0 Description: The issue concerns multiple HTML injection vulnerabilities in the parameters name, plugin sms api key, plugin sms country code, and title. This allows for potential malicious HTML...

Authelia applies regulation separately to Username-based logins to Email-based logins

Summary If users are allowed to sign in via both username and email the regulation system treats these as separate login events. This leads to the regulation limitations being effectively doubled assuming an attacker using brute-force to find a user password. It's important to note that due to th...

GHSA-M5MF-3963-4X26 Authelia applies regulation separately to Username-based logins to Email-based logins

Summary If users are allowed to sign in via both username and email the regulation system treats these as separate login events. This leads to the regulation limitations being effectively doubled assuming an attacker using brute-force to find a user password. It's important to note that due to th...

CVE-2024-13336

The Disable Auto Updates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the 'disable-auto-updates' page. This makes it possible for unauthenticated attackers to disable all auto...

CVE-2024-13336 Disable Auto Updates <= 1.4 - Cross-Site Request Forgery to Auto-update Disable

The Disable Auto Updates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the 'disable-auto-updates' page. This makes it possible for unauthenticated attackers to disable all auto...

CVE-2024-13336 Disable Auto Updates <= 1.4 - Cross-Site Request Forgery to Auto-update Disable

The Disable Auto Updates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the 'disable-auto-updates' page. This makes it possible for unauthenticated attackers to disable all auto...

kernel: misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume

A vulnerability was found in the lis3lv02di2c driver in the Linux kernel. This issue involves regulators being enabled and disabled twice during the suspend and resume process, which could lead to unintended behavior or system instability...

PT-2025-7583 · Bento4 · Bento4

Name of the Vulnerable Software and Affected Versions: Bento4 version 1.6.0-641 Description: A buffer overflow issue in Bento4 allows a local attacker to execute arbitrary code via the AP4 Stz2Atom::AP4 Stz2Atom component located in Ap4Stz2Atom.cpp. This enables local arbitrary code execution...

PT-2025-7338 · WordPress · The Wordpress Portfolio Builder – Portfolio Gallery

Name of the Vulnerable Software and Affected Versions: The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress versions up to, and including, 1.1.7 Description: The issue is related to unauthorized modification of data due to a missing capability check on the add video function...

Palo Alto Networks Cortex XDR 代码问题漏洞

Palo Alto Networks Cortex XDR is an extended detection and response platform that natively integrates network, endpoint, cloud, and third-party data from Palo Alto Networks, USA. A code issue vulnerability exists in Palo Alto Networks Cortex XDR, which stems from a faulty detection mechanism that...

WordPress plugin Disable Auto Updates 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

WordPress Disable Auto Updates plugin <= 1.4 - Cross-Site Request Forgery to Auto-update Disable vulnerability

Cross-Site Request Forgery to Auto-update Disable vulnerability discovered by SOPROBRO in WordPress Plugin Disable Auto Updates versions = 1.4...

PT-2025-25815

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.13.0-rc7+ Description A vulnerability in the Linux kernel has been resolved. The issue was observed on a SAMA5D27 platform using atmel serial, where a warning was emitted when trying to toggle flow control in a...

PT-2025-6897 · Microworld · Microword Escan Antivirus

Name of the Vulnerable Software and Affected Versions: MicroWord eScan Antivirus version 7.0.32 Description: A critical issue has been discovered affecting the sprintf function of the USB Password Handler component. This issue leads to a buffer overflow. The attack must be approached locally,...

PT-2025-6896 · Microworld · Microword Escan Antivirus

Name of the Vulnerable Software and Affected Versions: MicroWord eScan Antivirus version 7.0.32 Description: A critical issue has been found in the strcpy function of the VirusPopUp component, leading to a stack-based buffer overflow. The attack must be approached locally. The exploit has been...

PT-2025-6906

Name of the Vulnerable Software and Affected Versions: GNU elfutils version 0.192 Description: A problem has been found in GNU elfutils that affects the gelf getsymshndx function of the file strip.c in the eu-strip component. This issue leads to denial of service and must be approached locally. T...

PT-2025-6905

Name of the Vulnerable Software and Affected Versions: GNU elfutils version 0.192 Description: A vulnerability was found in GNU elfutils, affecting the function elf strptr in the library /libelf/elf strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to...