OESA-2025-2758 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A flaw was found in QEMU. An assertion failure was present in the usbepget function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious...

The vulnerability of the gettext module of the Grub2 operating system’s loader, which allows a hacker to cause a service failure

The vulnerability of the gettext loader module in the Grub2 operating system relates to the possibility of using memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the net_set_vlan() function in the Network loader module of the Grub2 operating system allows a hacker to cause a service failure.

The vulnerability of the netsetvlan function in the Grub2 operating system loader module involves the dereferencing of a pointer whose validity has expired. Exploiting this vulnerability could allow an attacker to cause a service failure...

📄 CodeIgniter CMS 4.2.0 SQL Injection

Proof of concept exploit for the CodeIgniter CMS version 4.2.0 remote SQL injection vulnerability. ============================================================================================================================================= | Title : CodeIgniter CMS 4.2.0 SQL Injection Exploit | ...

The vulnerability of Grub2 operating system loaders, related to the pointer aging mechanism, allows attackers to trigger a service failure and gain unauthorized access to the system.

The vulnerability of Grub2 operating system loaders is related to the pointer being set to an expired value. Exploiting this vulnerability can allow an attacker to cause a service failure and gain unauthorized access to the system...

The vulnerability of the normal_exit() function in the Grub2 operating system’s loader allows a hacker to trigger a service failure.

The vulnerability of the normalexit function in the Grub2 operating system loader is related to the pointer being reclaimed after its expiration. Exploiting this vulnerability could allow an attacker to trigger a service failure...

The vulnerability of Grub2 operating system loaders, related to the pointer aging mechanism, allows attackers to trigger a service failure.

The vulnerability of Grub2 operating system loaders is related to the pointer being set to an expired value. Exploiting this vulnerability can allow an attacker to cause a service failure...

EUVD-2025-199831

Mattermost versions 11.0.x = 11.0.2, 10.12.x = 10.12.1, 10.11.x = 10.11.4, 10.5.x = 10.5.12 fail to sanitize team email addresses to be visible only to Team Admins, which allows any authenticated user to view team email addresses via the GET /api/v4/channels/channelid/commonteams endpoint...

CVE-2025-13536

The Blubrry PowerPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 11.15.2. This is due to the plugin validating file extensions but not halting execution when validation fails in the...

CVE-2025-13536

The CVE targets the Blubrry PowerPress plugin for WordPress (versions up to and including 11.15.2). The root cause is insufficient file type validation: the plugin validates file extensions but does not halt execution when validation fails inside the powerpress_edit_post function, allowing authen...

CVE-2025-66252

Infinite Loop Denial of Service via Failed File Deletion in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Infinite loop when unlink fails in statuscontents.php causing DoS. Due to the...

Online Shopping Portal Insecure Direct Object Reference Vulnerability

Online Shopping Portal is an online store. Online Shopping Portal suffers from an insecure direct object reference vulnerability, which stems from the order tracking functionality not properly implementing an access control mechanism that directly references data sent from the client as an object...

PT-2025-52253

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel’s sch cake scheduler related to incorrect queue length qlen reduction within the cake drop function. The problem arises because cake enqueue assumes t...

The vulnerability of the ip6_output() function in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the ip6output function in the Linux operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the f_name() function in the Rsync file transfer and synchronization utility allows a malicious actor to trigger a service failure.

The vulnerability of the fname function in the Rsync file transfer and synchronization utility is related to the issue where the operation outputs values outside the buffer in memory due to an incorrect check on the array index. Exploiting this vulnerability could allow a remote attacker to cause...

PT-2026-37582

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the k3-socinfo component of the TI SoC System on Chip driver. The mmio regmap allocated during the probe process is not freed when a probe failure occurs, such as...

The vulnerability in the driver module edac/i10nm_base.c of the Linux operating system allows a hacker to cause a service failure.

The vulnerability in the driver module edac/i10nmbase.c of the Linux operating system is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2025-13644

MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSize. This issue affects MongoDB Server...

CVE-2025-13507

Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. This issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16 and MongoDB server v8...

CVE-2025-59390 Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.

Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret configuration is not explicitly set. In this case, the secret is generated using ThreadLocalRandom, which is not a crypto-graphically secure random number generator...