PT-2025-49627

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.0.0-rc2-00283-g10d4879f9ef0-dirty Description The Linux kernel had an issue where port I/O string accessors, such as insb and outsb, did not function correctly. These accessors used the physical PCI port I/O...

Intel® Xeon® 6 Processors with P-cores with Intel® TDX Connect Advisory

Summary: Potential security vulnerabilities for the Intel® Xeon® 6 Processors with P-cores with Intel® Trust Domain Extensions Connect Intel® TDX Connect may allow information disclosure or escalation of privilege. Intel is releasing guidance to address these potential vulnerabilities...

Vulnerability of the nvme_tcp_setup_ctrl() function in the driver/nvme/host/tcp.c module – A Linux kernel NVME driver that allows a hacker to cause a service failure

Vulnerability of the nvmetcpsetupctrl function in the driver/nvme/host/tcp.c module – The Linux kernel’s NVME support driver has a vulnerability where memory is not released after the effective lifespan has ended. Exploiting this vulnerability could allow an attacker to cause a service failure...

EUVD-2025-201549

Malicious code in express-my-error-handler npm...

MAL-2025-192350 Malicious code in express-my-error-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0f2d01a1484943569d365369896d46ee7229516152d056b0403048a740e7bcc The package express-my-error-handler was found to contain malicious code. Source: ghsa-malware...

Malicious code in express-my-error-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0f2d01a1484943569d365369896d46ee7229516152d056b0403048a740e7bcc The package express-my-error-handler was found to contain malicious code. Source: ghsa-malware...

CVE-2025-11379

The WebP Express plugin for WordPress is vulnerable to information exposure via config files in all versions up to, and including, 0.25.9. This is due to the plugin not properly randomizing the name of the config file to prevent direct access on NGINX. This makes it possible for unauthenticated...

The vulnerability of the web interface of the Cisco Unified Contact Center Express software tool allows a perpetrator to execute arbitrary code and gain increased privileges.

The vulnerability of the web interface of the Cisco Unified Contact Center Express Unified CCX software automation tool for operator operations is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to execute arbitrary code and increase the...

CVE-2025-40219

In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Fix race between SR-IOV enable/disable and hotplug Commit 05703271c3cd "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" tried to fix a race between the VF removal inside sriovdelvfs and concurrent...

CVE-2025-11379

The WebP Express plugin for WordPress is vulnerable to information exposure via config files in all versions up to, and including, 0.25.9. This is due to the plugin not properly randomizing the name of the config file to prevent direct access on NGINX. This makes it possible for unauthenticated...

EUVD-2025-201141

The WebP Express plugin for WordPress is vulnerable to information exposure via config files in all versions up to, and including, 0.25.9. This is due to the plugin not properly randomizing the name of the config file to prevent direct access on NGINX. This makes it possible for unauthenticated...

CVE-2025-11379

The CVE-2025-11379 entry refers to the WordPress WebP Express plugin being vulnerable to information exposure via config files in all versions up to 0.25.9. The root cause is described as the plugin not properly randomizing the config file name, allowing direct access on NGINX and enabling unauth...

CVE-2025-11379 WebP Express <= 0.25.9 - Unauthenticated Information Exposure

The WebP Express plugin for WordPress is vulnerable to information exposure via config files in all versions up to, and including, 0.25.9. This is due to the plugin not properly randomizing the name of the config file to prevent direct access on NGINX. This makes it possible for unauthenticated...

WordPress plugin WebP Express 信息泄露漏洞

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. An information disclosure vulnerability exists in the WordPress plugin WebP Express, which stem...

PT-2025-49003

The WebP Express plugin for WordPress is vulnerable to information exposure via config files in all versions up to, and including, 0.25.9. This is due to the plugin not properly randomizing the name of the config file to prevent direct access on NGINX. This makes it possible for unauthenticated...

WordPress WebP Express plugin <= 0.25.9 - Unauthenticated Information Exposure vulnerability

Unauthenticated Information Exposure vulnerability discovered by Rafshanzani Suhada in WordPress Plugin WebP Express versions = 0.25.9...

CVE-2025-64298

NMIS/BioDose V22.02 and previous version installations where the embedded Microsoft SQLServer Express is used are exposed in the Windows share accessed by clients in networked installs. By default, this directory has insecure directory paths that allow access to the SQL Server database and...

CVE-2025-64298 Mirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical Resource

NMIS/BioDose V22.02 and previous version installations where the embedded Microsoft SQLServer Express is used are exposed in the Windows share accessed by clients in networked installs. By default, this directory has insecure directory paths that allow access to the SQL Server database and...

CVE-2025-64298

CVE-2025-64298 affects NMIS/BioDose V22.02 and earlier where embedded Microsoft SQL Server Express is used. The vulnerability arises from insecure Windows share directory paths by default, enabling local users on networked client workstations to access the SQL Server database and configuration fi...

CVE-2025-64298 Mirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical Resource

NMIS/BioDose V22.02 and previous version installations where the embedded Microsoft SQLServer Express is used are exposed in the Windows share accessed by clients in networked installs. By default, this directory has insecure directory paths that allow access to the SQL Server database and...