PT-2026-20913

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.9 Description SPIP versions before 4.4.9 contain a Blind Server-Side Request Forgery SSRF issue related to syndicated sites within the private area. The application does not validate the syndication URL when editing ...

CVE-2025-15017

CVE-2025-15017 concerns serial device servers (notably Moxa NPort 5000 Series) where debugging code remains active in the UART interface. This allows a physically present attacker to connect to UART without authentication or user interaction, gaining unauthorized access to internal debug function...

SUSE CVE-2022-50818

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix runningreq for internal abort commands Disabling the remote phy for a SATA disk causes a hang: root@none$ more /sys/class/sasphy/phy-0:0:8/targetportprotocols sata root@none$ echo 0...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993276)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993276 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: put dlstid if fail to queue dlrecall Before calling nfsd4runcb to queue dlrecall to the...

Server-side Request Forgery (SSRF)

Overview feehi/cms is a Feehi CMS project template. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the TimThumb component in the timthumb.php file. An attacker can access internal resources or perform unauthorized requests by manipulating the src argument...

CVE-2025-69206

Hemmelig is a messing app with with client-side encryption and self-destructing messages. Prior to version 7.3.3, a Server-Side Request Forgery SSRF filter bypass vulnerability exists in the webhook URL validation of the Secret Requests feature. The application attempts to block internal/private ...

Malicious code in @peter_wilson12091/internal-json-test-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18430304f650bf998b2421e45c0b8b01fce58239d3dd6fbe9de753128aac9a4d The package @peterwilson12091/internal-json-test-parser was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-205797

Malicious code in @peterwilson12091/internal-json-test-parser npm...

EUVD-2022-55880

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix runningreq for internal abort commands Disabling the remote phy for a SATA disk causes a hang: root@none$ more /sys/class/sasphy/phy-0:0:8/targetportprotocols sata root@none$ echo 0...

CVE-2022-50818

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix runningreq for internal abort commands Disabling the remote phy for a SATA disk causes a hang: root@none$ more /sys/class/sasphy/phy-0:0:8/targetportprotocols sata root@none$ echo 0...

UBUNTU-CVE-2022-50818

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix runningreq for internal abort commands Disabling the remote phy for a SATA disk causes a hang: root@none$ more /sys/class/sasphy/phy-0:0:8/targetportprotocols sata root@none$ echo 0...

CVE-2022-50818

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix runningreq for internal abort commands Disabling the remote phy for a SATA disk causes a hang: root@none$ more /sys/class/sasphy/phy-0:0:8/targetportprotocols sata root@none$ echo 0...

CVE-2022-50818 scsi: pm8001: Fix running_req for internal abort commands

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix runningreq for internal abort commands Disabling the remote phy for a SATA disk causes a hang: root@none$ more /sys/class/sasphy/phy-0:0:8/targetportprotocols sata root@none$ echo 0...

CVE-2022-50818 scsi: pm8001: Fix running_req for internal abort commands

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix runningreq for internal abort commands Disabling the remote phy for a SATA disk causes a hang: root@none$ more /sys/class/sasphy/phy-0:0:8/targetportprotocols sata root@none$ echo 0...

CVE-2022-50818

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix runningreq for internal abort commands Disabling the remote phy for a SATA disk causes a hang: root@none$ more /sys/class/sasphy/phy-0:0:8/targetportprotocols sata root@none$ echo 0...

CVE-2022-50818

CVE-2022-50818 concerns the Linux kernel SCSI PM8001 subsystem. The fixed issue is in the per-device running_req accounting for internal abort commands: a race/defect prevented running_req from decrementing after internal abort completion, causing a hang in SAS/SATA paths (notably when disabling ...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992214)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992214 advisory. In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix use-after-free in acpiutcopyipackagetoipackage There is an use-after-free reported by...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from improper handling of the runningreq variable, which could cause the internal suspend command to hang...

PT-2025-53936

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.0.0-rc1-205202-gf26f8f761e83 218 Description A flaw exists in the SCSI subsystem of the Linux kernel, specifically within the pm8001 driver. The issue involves incorrect handling of the running req counter when...

hemmelig allows SSRF Filter bypass via Secret Request functionality

Summary A Server-Side Request Forgery SSRF filter bypass vulnerability exists in the webhook URL validation of the Secret Requests feature. The application attempts to block internal/private IP addresses but can be bypassed using DNS rebinding e.g., localtest.me which resolves to 127.0.0.1 or ope...