CVE-2025-31137 Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an...

CVE-2025-21961 eth: bnxt: fix truesize for mb-xdp-pass case

In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix truesize for mb-xdp-pass case When mb-xdp is set and return is XDPPASS, packet is converted from xdpbuff to skbuff with xdpupdateskbsharedinfo in bnxtxdpbuildskb. bnxtxdpbuildskb passes incorrect truesize argument ...

WordPress plugin Small Package Quotes – Worldwide Express Edition 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

react-router 环境问题漏洞

react-router is a declarative routing for React open-sourced by Remix. An environmental issue vulnerability exists in react-router versions 7.0.0 through 7.4.0, which stems from an Express adapter for Remix or React Router that allows request URLs to be forged via URL pathnames...

USN-7383-2 linux-realtime vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Drivers core; - Ublk userspace block driver; -...

pizzahotexpress.zfood.co.uk Cross Site Scripting vulnerability OBB-4036995

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

MAL-2025-2257 Malicious code in example-nodejs-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb2351b3777bfaea370237b22b5155a53e293162cb01bca791717b05107a4b7c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

VulnCheck KEV: CVE-2024-2876

The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IGESSubscribersQuery' class in all versions up to, and including, 5.7.14 due to insufficient...

MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a

...

AZL-69009 CVE-2025-21831 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 commit 9d26d3a8f1b0 "PCI: Put PCIe ports into D3 during suspend" sets the policy that all PCIe ports are allowed to use D3. When the system is suspended if the port...

DEBIAN-CVE-2025-21831

In the Linux kernel, the following vulnerability has been resolved: PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 commit 9d26d3a8f1b0 "PCI: Put PCIe ports into D3 during suspend" sets the policy that all PCIe ports are allowed to use D3. When the system is suspended if the port...

UBUNTU-CVE-2025-21831

In the Linux kernel, the following vulnerability has been resolved: PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 commit 9d26d3a8f1b0 "PCI: Put PCIe ports into D3 during suspend" sets the policy that all PCIe ports are allowed to use D3. When the system is suspended if the port...

CVE-2025-27268

CVE-2025-27268 affects the WordPress plugin Small Package Quotes – Worldwide Express Edition (versions up to 5.2.18). The issue is an SQL Injection caused by improper neutralization of special elements in SQL commands. The CVSS 3.1 vector reports Network attack on non-authenticated user with a Ch...

CVE-2025-27268 WordPress Small Package Quotes – Worldwide Express Edition Plugin <= 5.2.18 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in enituretechnology Small Package Quotes – Worldwide Express Edition small-package-quotes-wwe-edition allows SQL Injection.This issue affects Small Package Quotes – Worldwide Express Edition: from n/...

WordPress plugin Small Package Quotes – Worldwide Express Edition SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A SQL injection vulnerability exists in WordPress plugin...

Malicious code in falcor-express-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41a16c5f789993af6f19fffb815a56c859feacab1a40cb4b54ab9eb3ea92afef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1586 Malicious code in falcor-express-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41a16c5f789993af6f19fffb815a56c859feacab1a40cb4b54ab9eb3ea92afef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-1689

CVE-2025-1689 concerns ThemeMakers PayPal Express Checkout (WordPress plugin) versions

DEBIAN-CVE-2025-21788

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases If the XDP program doesn't result in XDPPASS then we leak the memory allocated by am65cpswbuildskb. It is pointless to allocate SKB memory before running the XDP...

AZL-62767 CVE-2024-58006 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Prevent changing BAR size/flags in pciepcsetbar In commit 4284c88fff0e "PCI: designware-ep: Allow pciepcsetbar update inbound map address" setbar was modified to support dynamically changing the backing physical...