CVE-2025-41706

CVE-2025-41706 affects the Phoenix Contact webserver used in the QUINT4-UPS/24DC/24DC/10/EIP family. The issue is a denial-of-service condition that an unauthenticated remote attacker can trigger by sending a specially crafted GET request with an over-long Content-Length header. The vulnerability...

EUVD-2025-34148

The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality...

CVE-2025-60535

Wallos v4.1.1 contains a CSRF in the component /endpoints/currency/currency that could allow an attacker to perform arbitrary operations via a crafted GET request. The CVE-2025-60535 entry consistently describes this CSRF as the underlying issue; Red Hat and ENISA/EUVD mirrors also reference the ...

PT-2025-41896

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 144 Firefox ESR versions prior to 140.4 Thunderbird versions prior to 144 Thunderbird versions prior to 140.4 Description A use-after-free issue exists in the MediaTrackGraphImpl::GetInstance function. This can occur...

CVE-2025-60535

A Cross-Site Request Forgery CSRF in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary operations via a crafted GET request...

Linux Distros Unpatched Vulnerability : CVE-2025-32916

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Potential use of sensitive information in GET requests in Checkmk GmbH's Checkmk versions 2.4.0p13, 2.3.0p38, 2.2.0p46, and 2.1.0 EOL may cause sensitive form...

The vulnerability of the ext4_get_group_info() function in the fs/ext4/ext4.h file of the Ext4 file system in the Linux operating system allows a attacker to cause a service failure.

The vulnerability of the ext4getgroupinfo function in the fs/ext4/ext4.h file of the Ext4 file system in the Linux operating system is related to buffer overflow attacks. Exploiting this vulnerability could allow an attacker to cause a service failure...

Get Projects School Management System 访问控制错误漏洞

Get Projects School Management System is an open source school management system software from Get Projects. An access control error vulnerability exists in Get Projects School Management System that stems from a lack of authentication and could lead to a remote attack...

Get Projects School Management System 代码问题漏洞

Get Projects School Management System is a Get Projects open source school management system software. A code issue vulnerability exists in Get Projects School Management System, which stems from a misbehavior of the parameter File in the file /assets/uploadSllyabus.php, which could lead to...

CVE-2025-61665

WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Broken Access Control vulnerability, identified in the getrelatoriossocios.php endpoint. This vulnerability allows unauthenticated attackers to directly access sensitive personal and...

CVE-2025-11629

RainyGao DocSys up to version 2.02.36 contains a SQL injection in the getUserList function (/Manage/getUserList.do). The vulnerability allows remote exploitation; exploit information has been disclosed publicly. Multiple sources (Red Hat, EU ENISA, CVE records, and PT Security) consistently ident...

PT-2025-41683

Name of the Vulnerable Software and Affected Versions Error Log Viewer by BestWebSoft plugin for WordPress versions up to and including 1.1.6 Description The Error Log Viewer by BestWebSoft plugin for WordPress is susceptible to Directory Traversal. This allows authenticated attackers with...

Parallax is vulnerable to DoS via malicious p2p message

Impact A vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node. In order to carry out the attack, the attacker establishes a peer connections to the victim, and sends a malicious GetBlockHeadersRequest message...

CVE-2025-59976

An arbitrary file download vulnerability in the web interface of Juniper Networks Junos Space allows a network-based authenticated attacker using a crafted GET method to access any file on the file system. Using specially crafted GET methods, an attacker can gain access to files beyond the file...

CVE-2025-32916

Potential use of sensitive information in GET requests in Checkmk GmbH's Checkmk versions 2.4.0p13, 2.3.0p38, 2.2.0p46, and 2.1.0 EOL may cause sensitive form data to be included in URL query parameters, which may be logged in various places such as browser history or web server logs...

JLSEC-2025-37 libcurl's URL API function [`curl_url_get()`](https://curl.se/libcurl/c/curl_url_get.html) offers...

libcurl's URL API function curlurlget offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the macidn IDN backend. The conversion function then fills up the provided buffer exact...

CVE-2025-11166

The WP Go Maps formerly WP Google Maps plugin for WordPress is vulnerable to Cross-Site Request Forgery CSRF in all versions up to, and including, 9.0.46. This is due to the plugin exposing state-changing REST actions through an AJAX bridge without proper CSRF token validation, and having...

CVE-2025-44823

Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/getusers call. This is GL:NLS475...

f2fs: fix to account dirty data in __get_secs_required()

...

RockyLinux 10 : kernel (RLSA-2025:10854)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:10854 advisory. kernel: exfat: fix random stack corruption after getblock CVE-2025-22036 Tenable has extracted the preceding description block directly from the RockyLinux...