CVE-2025-13471 User Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option Update

The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 for example to enable User Registration when it has been turned off...

EUVD-2025-206412

The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 for example to enable User Registration when it has been turned off...

PT-2026-5057

The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 for example to enable User Registration when it has been turned off...

PT-2026-36384

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the comedi ni atmio16d driver where the atmio16d detach handler function calls reset atmio16d unconditionally during a failed attach process. If the atmio16d attach...

CVE-2025-12810

Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem RPC Password Rotation modules.This issue affects Secret Server On-Prem: 11.8.1, 11.9.6, 11.9.25. A secret with "change password on check in" enabled automatically checks in even when the password change fails after reachi...

CVE-2025-12810

Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem RPC Password Rotation modules.This issue affects Secret Server On-Prem: 11.8.1, 11.9.6, 11.9.25. A secret with "change password on check in" enabled automatically checks in even when the password change fails after reachi...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005134)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005134 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: fix timer use-after-free on failed mount Syzbot has found an ODEBUG bug in ext4fillsuper Th...

Azure Linux 3.0 Security Update: kernel (CVE-2024-49960)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-49960 advisory. - In the Linux kernel, the following vulnerability has been resolved: ext4: fix timer use-after-free on failed...

Azure Linux 3.0 Security Update: kernel (CVE-2025-37849)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-37849 advisory. - In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Tear down vGIC on failed vCP...

CVE-2025-68139 In EVerest, by default, the EV is responsible for closing the connection if the module encounters an error during request processing

EVerest is an EV charging software stack. In all versions up to and including 2025.12.1, the default value for terminateconnectiononfailedresponse is False, which leaves the responsibility for session and connection termination to the EV. In this configuration, any errors encountered by the modul...

CVE-2025-68139

EVerest is an EV charging software stack. In all versions up to and including 2025.12.1, the default value for terminateconnectiononfailedresponse is False, which leaves the responsibility for session and connection termination to the EV. In this configuration, any errors encountered by the modul...

CVE-2025-68139 In EVerest, by default, the EV is responsible for closing the connection if the module encounters an error during request processing

EVerest is an EV charging software stack. In all versions up to and including 2025.12.1, the default value for terminateconnectiononfailedresponse is False, which leaves the responsibility for session and connection termination to the EV. In this configuration, any errors encountered by the modul...

CVE-2025-68139

CVE-2025-68139 affects EVerest EV charging software stack. All versions up to and including 2025.12.1 default terminate_connection_on_failed_response to false, meaning the EV is responsible for closing sessions/connections after module errors; errors are logged but no automatic countermeasures (e...

CVE-2025-68139 In EVerest, by default, the EV is responsible for closing the connection if the module encounters an error during request processing

EVerest is an EV charging software stack. In all versions up to and including 2025.12.1, the default value for terminateconnectiononfailedresponse is False, which leaves the responsibility for session and connection termination to the EV. In this configuration, any errors encountered by the modul...

CVE-2025-54495

A reflected cross-site scripting xss vulnerability exists in the emailfailedjob functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious url can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability...

PT-2026-3852

EVerest is an EV charging software stack. In all versions up to and including 2025.12.1, the default value for terminate connection on failed response is False, which leaves the responsibility for session and connection termination to the EV. In this configuration, any errors encountered by the...

Everest-core authorization issue vulnerability

Everest-core is a major component of the open-source electric vehicle charging software stack developed by EVerest. Versions of Everest-core prior to 2025.12.1 contained an authorization vulnerability. This vulnerability stemmed from the default configuration of...

CVE-2025-54495

CVE-2025-54495 is a reflected xss vulnerability in MedDream PACS Premium 7.3.6.870, specifically in the emailfailedjob.php flow. Cisco Talos identifies a post-authenticated flaw where the value of the jobid parameter is written into HTML output without sanitization, enabling arbitrary JavaScript ...

CVE-2025-54495

A reflected cross-site scripting xss vulnerability exists in the emailfailedjob functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious url can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability...

PT-2026-3599

Name of the Vulnerable Software and Affected Versions MedDream PACS Premium version 7.3.6.870 Description A reflected cross-site scripting xss issue exists in the emailfailedjob functionality. A crafted URL can lead to arbitrary javascript code execution. An attacker can provide a malicious URL t...