PT-2025-16935 · WordPress · Icegram Express

Name of the Vulnerable Software and Affected Versions: The Icegram Express formerly known as Email Subscribers WordPress plugin versions prior to 5.7.52 Description: The issue concerns the Icegram Express WordPress plugin, which does not properly sanitise and escape some of its settings. This cou...

WordPress plugin Icegram Express 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

UBUNTU-CVE-2025-22095

In the Linux kernel, the following vulnerability has been resolved: PCI: brcmstb: Fix error path after a call to regulatorbulkget If the regulatorbulkget returns an error and no regulators are created, we need to set their number to zero. If we don't do this and the PCIe link up fails, a call to...

DEBIAN-CVE-2025-22031

In the Linux kernel, the following vulnerability has been resolved: PCI/bwctrl: Fix NULL pointer dereference on bus number exhaustion When BIOS neglects to assign bus numbers to PCI bridges, the kernel attempts to correct that during PCI device enumeration. If it runs out of bus numbers, no pcibu...

DEBIAN-CVE-2024-58093

In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix link state exit during switch upstream function removal Before 456d8aa37d0f "PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free", we would free the ASPM link only after the last function on the b...

UBUNTU-CVE-2024-58093

In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix link state exit during switch upstream function removal Before 456d8aa37d0f "PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free", we would free the ASPM link only after the last function on the b...

CVE-2024-58093

CVE-2024-58093 affects the Linux kernel’s PCI/ASPM link state handling. The issue arises when removing functions on a bus with a PCIe switch/MFD: freeing the ASPM link state either too late (function 0 removed last) or too early (before all subordinate links are gone), leading to use-after-free o...

Host Header Injection

@react-router/express, @remix-run/express is vulnerable to Host header injection. The vulnerability exists due to improper validation of the Host and X-Forwarded-Host headers, allowing attackers to spoof the request URL by injecting a pathname into the port section of the header...

CVE-2025-31137

React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an...

CVE-2025-30915

Missing Authorization vulnerability in enituretechnology Small Package Quotes – Worldwide Express Edition small-package-quotes-wwe-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Small Package Quotes – Worldwide Express Edition: from n/a through ...

CVE-2025-30915 WordPress Small Package Quotes – Worldwide Express Edition plugin <= 5.2.19 - Broken Access Control vulnerability

Missing Authorization vulnerability in enituretechnology Small Package Quotes – Worldwide Express Edition small-package-quotes-wwe-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Small Package Quotes – Worldwide Express Edition: from n/a through ...

The vulnerability of the nvme_stop_ctrl() function in the Linux kernel driver for NVME support allows a attacker to cause a service failure.

The vulnerability of the nvmestopctrl function in the Linux kernel driver for NVME storage devices is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to cause a service failure...

@diffuse-dev/particles-ui (0.0.53), @react-router/serve (>=7.0.0-pre.0, <=7.4.0) +2 more potentially affected by CVE-2025-31137 via @react-router/express (>=7.0.0, <=7.4.0-pre.0)

@react-router/express NPM version =7.0.0, =7.0.0-pre.0, =0.1.0-xyd.22, =0.1.0-xyd.20, =0.1.0-xyd.29 Source cves: CVE-2025-31137 Source advisory: OSV:GHSA-4Q56-CRQP-V477...

@common-stack/frontend-stack-react (>=8.0.1-alpha.0, <=8.4.1-alpha.0), @epic-web/workshop-app (>=5.6.0, <=5.28.0) +4 more potentially affected by CVE-2025-31137 via @remix-run/express (>=2.11.1, <=2.16.2-pre.0)

@remix-run/express NPM version =2.11.1, =8.0.1-alpha.0, =5.6.0, =0.1.49, =2.11.1-pre.0, =0.0.5, =3.0.0, =3.4.6 Source cves: CVE-2025-31137 Source advisory: OSV:GHSA-4Q56-CRQP-V477...

GHSA-4Q56-CRQP-V477 Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

Impact We received a report about a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL...

Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

Impact We received a report about a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL...

CVE-2025-31137

React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an...

CVE-2025-31137

Summary: A Host/X-Forwarded-Host header manipulation vulnerability in Remix/React Router affects Remix 2 and React Router 7 users using the Express adapter. An attacker can spoof the incoming Request URL by placing a pathname in the URL’s port section of a header-hosted URL, potentially altering ...

CVE-2025-31137 Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an...

CVE-2025-31137 Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an...