The vulnerability of the __cpu_die() function in the arch/powerpc/kernel/smp.c module, which is part of the PowerPC platform support for the Linux operating system, allows a hacker to trigger a service failure.

The vulnerability of the cpudie function in the arch/powerpc/kernel/smp.c module of the PowerPC platform support for the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the grandparent() function in the drivers/cxl/core/port.c file of the CXL device support driver for the Linux operating system allows a malicious actor to cause a service failure.

The vulnerability of the grandparent function in the drivers/cxl/core/port.c file of the CXL device support driver for the Linux operating system is related to improper resource locking. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the gmc_v10_0_hw_fini() function in the drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c driver module allows a hacker to cause a service failure in AMD GPU-based Linux operating system Direct Rendering Infrastructure (DRI).

The vulnerability of the gmcv100hwfini function in the drivers/gpu/drm/amd/amdgpu/gmcv100.c driver module relates to the lack of memory release after the effective lifespan of the function. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the call_usermodehelper_exec() function in the kernel/umh.c module of the Linux operating system allows a hacker to induce a service failure.

The vulnerability of the callusermodehelperexec function in the kernel/umh.c module of the Linux operating system is related to errors in system configuration or settings. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the spi_add_device() function in the drivers/spi/spi.c module of the Linux kernel’s SPI device support driver allows a attacker to cause a service failure.

The vulnerability of the spiadddevice function in the drivers/spi/spi.c module of the Linux kernel’s SPI device support driver relates to improper locking of resources. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2025-62626

Improper handling of insufficient entropy in the AMD CPUs could allow a local attacker to influence the values returned by the RDSEED instruction, potentially resulting in the consumption of insufficiently random values...

kea security update

An update is available for kea. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list DHCP implementation from Internet Systems Consortium, Inc. that features fully...

JLSEC-2025-214 Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an...

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtlssslsetsession failure...

EUVD-2025-198437

In the Linux kernel, the following vulnerability has been resolved: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" I've found that pynfs COMP6 now leaves the connection or lease in a strange state, which causes CLOSE9 to hang indefinitely. I've dug into it a little, but ...

EUVD-2025-198387

The HotelRunner Booking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hotelrunner' shortcode in all versions up to, and including, 5.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-11885

CVE-2025-11885 : WordPress EchBay Admin Security plugin suffers a Reflected XSS via the _ebnonce parameter in versions up to 1.3.0 due to insufficient input sanitization and output escaping. Unauthenticated attackers could entice a user to perform an action (e.g., click a link) and have arbitrary...

The vulnerability of the Go programming language’s encoding/ASN1 component, which allows a hacker to trigger a service failure.

The vulnerability of the Go programming language’s encoding/ASN1 component is related to the lack of memory release after the effective lifespan of the component. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

CVE-2025-12349

The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Authorization in versions up to, and including, 5.9.10. This is due to the plugin not properly verifying that a user is authorized to perform an action in the...

Tenda AC21 安全漏洞

Tenda AC21 is a dual-band Gigabit wireless router launched by Tenda Technology, designed for home high-speed Internet needs, supporting 802.11acwave2 technology, dual-band concurrent rate up to 2033Mbps, of which the 5GHz band rate up to 1733Mbps, to meet the high-bandwidth applications, such as ...

TencentOS Server 3: redis:6 (TSSA-2025:0105)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0105 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

TencentOS Server 4: gnupg2 (TSSA-2025:0283)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0283 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

UBUNTU-CVE-2025-47914

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read...

When the Internet Fails Again, Will You Survive a DDoS Attack?

...

CVE-2025-56643

Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and can be reused to access the system, even after logout. This behavior affects session integrity and may allow unauthorized access if a toke...

authentik 安全漏洞

authentik is an open source identity provisioning application from authentik Open Source. A security vulnerability exists in authentik versions prior to 2025.8.5 and prior to 2025.10.2, which stems from a service account that can still be authenticated after deactivation, potentially leading to...