CVE-2025-64065

The Primakon Pi Portal 1.0.18 API /api/V2/ppudfvadmin endpoint, fails to perform necessary server-side validation. The administrative LoginAs or user impersonation feature is vulnerable to a access control failure. This flaw allows any authenticated low-privileged user to execute a direct PATCH...

MongoDB Server 安全漏洞

MongoDB Server is a set of open source NoSQL databases from the American company MongoDB. The database provides collection-oriented storage, dynamic querying, data replication and automatic failover. A security vulnerability exists in MongoDB Server version v7.0 up to and including version 7.0.26...

The vulnerability of Instantel Micromate software lies in the lack of authentication for a critical function, allowing attackers to execute arbitrary commands.

The vulnerability of Instantel Micromate software is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the btrfs_encode_fh() function in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the btrfsencodefh function in the Linux operating system’s kernel is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the page_pool_page_is_pp() function in the include/linux/mm.h and net/core/page_pool.c modules of the Linux operating system allows a attacker to cause a service failure.

The vulnerability of the pagepoolpageispp function in the include/linux/mm.h and net/core/pagepool.c modules of the Linux kernel is related to the execution of operations outside of memory buffers. Exploiting this vulnerability could allow an attacker to cause a service failure...

MongoDB -- Reachable Assertion

https://jira.mongodb.org/browse/SERVER-101180 reports: MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size...

PT-2025-47989

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 7.0.26 MongoDB Server versions prior to 8.0.16 MongoDB Server versions prior to 8.2.1 Description An issue exists in the time series processing logic where inconsistent object size validation can lead to the...

CVE-2025-64063

Primakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks when processing requests. Specifically, a standard user can exploit this flaw by sending direct HTTP requests to administrative endpoints, bypassing the UI restrictions. This allows the attacker to manipulate...

CVE-2025-64065

Primakon Pi Portal 1.0.18 exposes /api/V2/pp_udfv_admin to authenticated, low-privilege users via an access control flaw (Broken Function Level Authorization) and insecure design, enabling direct PATCH-based impersonation of arbitrary users, including Administrators, without password or admin tok...

CVE-2025-64067

CVE-2025-64067 affects Primakon Pi Portal 1.0.18 APIs where endpoints that return object-specific or filtered data fail to verify that the requester is authorized for the target data. This enables unauthorized access through: (1) Direct ID manipulation/IDOR by altering identifiers like user_id or...

The vulnerability of the pathPut() function in the fs/namespace.c module of the Linux kernel allows a hacker to cause a service failure.

The vulnerability of the pathPut function in the fs/namespace.c module of the Linux kernel is related to insufficient resource control during its existence. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2025-63432

Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate Validation. The application fails to properly validate the TLS certificate from its update server. An attacker on the same network can exploit this vulnerability by performing a Man-in-the-Middle MITM attack ...

EUVD-2025-198707

Use after free in endpoint destructors in Redboltz asyncmqtt 10.2.5 allows local users to cause a denial of service via triggering SSL initialization failure that results in incorrect destruction order between iocontext and endpoint objects...

CVE-2025-65503

Use after free in endpoint destructors in Redboltz asyncmqtt 10.2.5 allows local users to cause a denial of service via triggering SSL initialization failure that results in incorrect destruction order between iocontext and endpoint objects...

CVE-2025-65503

CVE-2025-65503 concerns a use-after-free in endpoint destructors of Redboltz async_mqtt 10.2.5, leading to denial of service when SSL initialization fails due to incorrect destruction order between io_context and endpoint objects. Affected component is the endpoint destructor in the Redboltz asyn...

The vulnerability of the mnt_ns_release() function in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the mntnsrelease function in the Linux operating system’s kernel is related to pointer manipulation. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability in the virtblk_probe() function of the drivers/block/virtio_blk.c module of the Linux kernel’s block device support driver allows a attacker to cause a service failure.

The vulnerability of the virtblkprobe function in the drivers/block/virtioblk.c file of the Linux kernel’s block device support driver is related to a numerical overflow vulnerability. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the `ceph_netfs_issue_read()` function in the `fs/ceph/addr.c` module, which is part of the Ceph distributed file system support for Linux kernels, allows a attacker to cause a service failure.

The vulnerability of the cephnetfsissueread function in the fs/ceph/addr.c module of the Ceph distributed file system support module for Linux operating systems is related to insufficient input validation. Exploiting this vulnerability could allow an attacker to cause a service failure...

JavaScript component vulnerability: Mozilla Firefox and Firefox ESR browsers’ WebAssembly feature allows attackers to trigger a service failure.

JavaScript component vulnerability: Mozilla Firefox and Firefox ESR browsers’ WebAssembly feature are related to operations that go beyond buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

The vulnerability of the sugov_tunables_alloc() function in the kernel/sched/cpufreq_schedutil.c module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the sugovtunablesalloc function in the kernel/sched/cpufreqschedutil.c module of the Linux operating system is related to the release of an incorrect pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...