EUVD-2025-35880

D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEnableWizard...

CVE-2025-60554

D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEnableWizard...

CVE-2025-60554

D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEnableWizard...

EUVD-2022-54769

In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: rk3399dmc: Disable edev on remove Otherwise we hit an unablanced enable-count when unbinding the DFI device: 1279.659119 ------------ cut here ------------ 1279.659179 WARNING: CPU: 2 PID: 5638 at...

UBUNTU-CVE-2022-50565

In the Linux kernel, the following vulnerability has been resolved: wifi: plfxlc: fix potential memory leak in lfxusbenablerx urbs does not be freed in exception paths in lfxusbenablerx. That will trigger memory leak. To fix it, add kfree for urbs within "error" label. Compile tested only...

CVE-2023-53725

CVE-2023-53725 affects the Linux kernel Cadence TTC clocksource driver, specifically the ttc_timer_probe path. The vulnerability is described as a memory leak caused by the base IO mapping not being released. The provided fixes replace the non-managed iomap usage with devm_of_iomap() and add clea...

CVE-2023-53723 drm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspend

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspend sdmav40ip is shared on a few asics, but in sdmav40hwfini, driver unconditionally disables eccirq which is only enabled on those asics enabling sdma ecc. Th...

CVE-2022-50565 wifi: plfxlc: fix potential memory leak in __lf_x_usb_enable_rx()

In the Linux kernel, the following vulnerability has been resolved: wifi: plfxlc: fix potential memory leak in lfxusbenablerx urbs does not be freed in exception paths in lfxusbenablerx. That will trigger memory leak. To fix it, add kfree for urbs within "error" label. Compile tested only...

Shopware Customer Orders can be canceled, even if refunds are disabled

Refunds in general can be enabled through the administration setting core.cart.enableOrderRefunds in the cart panel.Which visually shows and hides the button. However, using a custom crafted request, a customer can still cancel his own orders.As this is not checked inside the route and also not i...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987538)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987538 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix gart.bo pincount leak gmcv9,100gartdisable isn't called matched with correspoding...

EUVD-2025-34704

The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the enableunfilteredfilesupload function. This makes it possible for unauthenticated...

Tenda AC7 /goform/saveAutoQos File Buffer Overflow Vulnerability

Tenda AC7 is a wireless router from Tenda, a Chinese company. A buffer overflow vulnerability exists in Tenda AC7 version 15.03.06.44, which originates from the parameter enable in the file /goform/saveAutoQos that fails to correctly validate the length of the input data, and can be exploited by ...

Tenda AC7 /goform/SetDDNSCfg File Buffer Overflow Vulnerability

Tenda AC7 is a wireless router from Tenda, a Chinese company. A buffer overflow vulnerability exists in Tenda AC7 version 15.03.06.44, which originates from the parameter ddnsEn in the file /goform/SetDDNSCfg that fails to correctly validate the length and size of the input data, and can be...

Microsoft Limits IE Mode in Edge After Chakra Zero-Day Activity Detected

Microsoft restricted access to Edge's IE Mode in August 2025 after hackers used a Chakra zero-day flaw to bypass security and take over user devices. Check out the new steps for enabling IE Mode...

Tenda AC15 formsaveAutoQos function buffer overflow vulnerability

The Tenda AC15 is a wireless router from the Chinese company Tenda. A buffer overflow vulnerability exists in Tenda AC15 version 15.03.05.18, which originates from the parameter enable in the file /goform/saveAutoQos that fails to correctly validate the length of the input data, and can be...

CVE-2025-9496

The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's filemodified shortcode in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

EUVD-2025-33820

The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's filemodified shortcode in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-9496

CVE-2025-9496 affects the Enable Media Replace WordPress plugin (up to version 4.1.6). Root cause: stored XSS via the file_modified shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. Impact: authenticated attackers withContributor+ access can inject ...

CVE-2025-9496 Enable Media Replace <= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified Shortcode

The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's filemodified shortcode in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-9496 Enable Media Replace <= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified Shortcode

The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's filemodified shortcode in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...