CVE-2025-55159 slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check

slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the getdisjointmut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has...

PT-2025-32490 · Unknown · 猫宁I Morning

Name of the Vulnerable Software and Affected Versions: 猫宁i Morning affected versions not specified Description: A critical path traversal issue exists in the Shiro Configuration component of 猫宁i Morning. The issue affects an unknown function within the /index file. This allows for remote...

CVE-2025-54368 uv is vulnerable to ZIP payload obfuscation through parsing differentials

uv is a Python package and project manager written in Rust. In versions 0.8.5 and earlier, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. An attacker could contrive a ZIP archive that would extract with...

PT-2025-32411 · Myblog · Myblog

Name of the Vulnerable Software and Affected Versions: zhenfeng13 My-Blog versions up to 1.0.0 Description: A cross-site request forgery issue exists due to the manipulation of the tagName argument in the processing of the /admin/tags/save API endpoint. The attack can be initiated remotely. The...

PT-2025-46631

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A flaw exists in the Linux kernel’s PM / devfreq subsystem, specifically within the mtk-cci component. The drv-sram reg pointer could be assigned an error value, potentially leading to a...

Oracle Linux 8 : python-requests (ELSA-2025-13234)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-13234 advisory. 2.20.0-6 - Security fix for CVE-2024-47081 Resolves: RHEL-102420 Tenable has extracted the preceding description block directly from the Oracle Linux security...

PT-2025-44678

Name of the Vulnerable Software and Affected Versions Google Chrome affected versions not specified Description A flaw exists in Google Chrome that could allow attackers to impact the system. The issue is related to an inappropriate implementation within the Extensions component. Recommendations ...

PT-2025-32202 · Poco +1 · Poco +1

Name of the Vulnerable Software and Affected Versions: poco version 1.14.1-release Description: poco version 1.14.1-release was discovered to contain weak encryption. There is a dispute regarding this issue, with some arguing that key lengths are expected to be set by the application using the...

CVE-2025-54571

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrate...

CVE-2025-54135

Cursor before v1.3.9 allows prompt-injection via MCP MCP server data to auto-run and write to ~/.cursor/mcp.json, enabling RCE when processing external content. Affected: Cursor AI code editor (Cursor) in-workspace file writes without user approval; dotfiles require approval but new dotfiles do n...

PT-2025-34760

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A stack buffer overflow in the iommu/amd component of the Linux kernel was addressed. The vulnerability occurs when handling the kernel command line, specifically when processing the...

SUSE CVE-2025-54388

Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including...

DEBIAN-CVE-2025-54410

Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. A firewalld vulnerability affects Moby releases before 28.0.0. When firewalld reloads, Docker fails to re-create...

CVE-2025-8220

A vulnerability has been found in Engeman Web up to 12.0.0.2. The affected element is an unknown function of the file /Login/RecoveryPass of the component Password Recovery Page. The manipulation of the argument LanguageCombobox as part of Cookie leads to sql injection. The attack is possible to ...

CVE-2025-53945

CVE-2025-53945 concerns apko, Chainguard’s tool for building/publishing OCI images. Affected versions prior to 0.29.5 inadvertently set critical files to 0666 permissions, notably /etc/ld.so.cache, enabling a local unprivileged user to potentially influence the dynamic loader path by placing a ma...

WordPress Videopack plugin <= 4.10.3 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by 63n0 in WordPress Plugin Videopack versions = 4.10.3...

CVE-2025-53819 Nix's privilege dropping to build user broke for macOS

Nix is a package manager for Linux and other Unix systems. Builds with Nix 2.30.0 on macOS were executed with elevated privileges root, instead of the build users. The fix was applied to Nix 2.30.1. No known workarounds are available...

CVE-2025-53819

Nix is a package manager for Linux and other Unix systems. Builds with Nix 2.30.0 on macOS were executed with elevated privileges root, instead of the build users. The fix was applied to Nix 2.30.1. No known workarounds are available...

PT-2025-33758

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A flaw exists in the platform/x86/intel/pmt component of the Linux kernel related to a NULL pointer dereference when using intel pmt read for binary sysfs. This occurs when a pcidev is...

CVE-2025-24798

Meshtastic is an open source mesh networking solution. From 1.2.1 until 2.6.2, a packet sent to the routing module that contains wantresponse==true causes a crash. This can lead to a degradation of service for nodes within range of a malicious sender, or via MQTT if downlink is enabled. This...