SUSE CVE-2025-23259

NVIDIA Mellanox DPDK contains a vulnerability in Poll Mode Driver PMD, where an attacker on a VM in the system might be able to cause information disclosure and denial of service on the network interface...

Linux nft_objref Heap Buffer Overflow DoS

The vulnerability in the net/netfilter/nftobjref.c module of the Linux operating system is related to an uncontrolled recursion. Exploiting this vulnerability could allow a attacker to cause a service failure...

SquashFS Heap Buffer Overflow DoS

The vulnerability of the squashfsread inode function in the SquashFS file system of Linux operating systems is related to the comparison of numerical ranges without any minimum checks. Exploiting this vulnerability could allow a attacker to cause a service failure...

Oracle Linux 8 : cups (ELSA-2025-22063)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-22063 advisory. 1:2.2.6-64 - RHEL-122666 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ippreadio Leading to Remote DoS Tenable has extracted the preceding description...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unknown fields that aren't checked. An attacker can disrupt consensus and cause all block proposals to be rejected by submitting specially crafted vote extensions with...

Improper Validation of Specified Type of Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the NudmSubscriberDataManagement API. An attacker can disrupt service availability by sending crafted requests to this API endpoint. Remediation Upgrade...

Improper Check or Handling of Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Check or Handling of Exceptional Conditions via the NpcfBDTPolicyControl API when processing crafted POST requests. An attacker can disrupt service availability by sending specially crafted requests. Remediation Upgrade...

Improper Check or Handling of Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Check or Handling of Exceptional Conditions via the NpcfBDTPolicyControl API when processing crafted POST requests. An attacker can disrupt service availability by sending specially crafted requests. Remediation Upgrade...

Audio/Video Mozilla Firefox ESR DoS

The vulnerability of the Audio/Video components in Mozilla Firefox and Firefox ESR lies in the ability to utilize memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

Spotfire Server Software Code Execution

The vulnerabilities of the security mechanism of the Spotfire Server Software, the Visualization and Extended Data Analysis Platform Spotfire Analyst, the Spotfire Enterprise Runtime Download Manager, the Deployment Kit Download Manager, the Spotfire Desktop Data Analysis Application, and the...

D-Link Router Code Execution

The vulnerability of the embedded web server microprogramming software in D-Link routers such as DWR-M920, DWR-M921, DIR-822K, and DIR-825M is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

devfreq_monitor Heap Buffer Overflow DoS

The vulnerability of the devfreqmonitor function in the drivers/devfreq/devfreq.c driver module, which supports dynamic scaling of voltage and frequency DVFS for the Linux operating system’s kernel, stems from the execution of a loop with an unreachable exit condition. Exploiting this vulnerabili...

The Dark Side of Flexibility: How Aggregated Cyberattacks Threaten the Power Grid

Flexible energy resources are increasingly becoming common in smart grids. These resources are typically managed and controlled by aggregators that coordinate many resources to provide flexibility services. However, these aggregators and flexible energy resources are vulnerable, which could allow...

CVE-2025-65033

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the poll management feature allows any authenticated user to pause or resume any poll, regardless of ownership. The system only uses the public pollId to identify polls, and it does not...

TencentOS Server 4: qemu (TSSA-2025:0635)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0635 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Atlassian Confluence < 8.5.25 / 8.6.x < 9.2.7 / 9.3.x < 10.0.2 (CONFSERVER-100907)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-100907 advisory. - A vulnerability introduced in Confluence Data Center 2.0 allows a unauthenticated remote attacker to render the host unavailable for its intended...

CVE-2025-65033 Rallly Broken Authorization: Any User Can Pause or Resume Any Poll via Poll ID Manipulation

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the poll management feature allows any authenticated user to pause or resume any poll, regardless of ownership. The system only uses the public pollId to identify polls, and it does not...

CVE-2025-12524

The Post Type Switcher plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.0 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to modify the post type...

EUVD-2025-198086

A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting...

CVE-2025-37161

A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting...