Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel, which stems from a memory leak in the loadelfbinary function that could lead to memory exhaustion...

PT-2025-40177

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw where a failure from devlink alloc was not properly handled. Specifically, a check for a NULL return value from the devlink alloc function was missing. I...

PT-2025-40151

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the load elf binary function within the Linux kernel's fs/binfmt elf component. This leak occurs when interp elf ex fails to allocate memory, leading to an...

CVE-2025-7038

The vulnerability CVE-2025-7038 affects LatePoint for WordPress (up to v5.1.94). The issue is an Authentication Bypass in the steps__load_step path of the latepoint_route_call AJAX endpoint, where client-supplied customer email/fields are used before login verification or nonce checks. Unauthenti...

UBUNTU-CVE-2025-59933

libvips is a demand-driven, horizontally threaded image processing library. For versions 8.17.1 and below, when libvips is compiled with support for PDF input via poppler, the pdfload operation is affected by a buffer read overflow when parsing the header of a crafted PDF with a page that defines...

CVE-2025-59933

CVE-2025-59933 affects libvips prior to 8.17.2 when built with PDF support via poppler. A buffer read overflow occurs in pdfload during header parsing of crafted PDFs that define a width but not a height. Affected versions: 8.17.1 and earlier; unaffected when built without PDF support or with PDF...

CVE-2025-11135 pmTicket Project-Management-Software Cookie class.database.php loadLanguage deserialization

A vulnerability was detected in pmTicket Project-Management-Software up to 2ef379da2075f4761a2c9029cf91d073474e7486. The affected element is the function loadLanguage of the file classes/class.database.php of the component Cookie Handler. Performing manipulation of the argument userid results in...

CVE-2025-11013

A vulnerability was identified in BehaviorTree up to 4.7.0. This vulnerability affects the function XMLParser::PImpl::loadDocImpl of the file /src/xmlparsing.cpp of the component XML Parser. The manipulation leads to null pointer dereference. The attack can only be performed from a local...

CLSA-2025-1758896091 gdk-pixbuf2: Fix of CVE-2025-7345

CVE-2025-7345: fix heap buffer overflow during base64 encoding in gdkpixbufjpegimageloadincrement...

OESA-2025-2327 openssl security update

The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, fully featured, and Open Source toolkit implementing the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocols as well as a full-strength general purpose cryptography library. The project i...

CVE-2025-11013 BehaviorTree XML Parser xml_parsing.cpp loadDocImpl null pointer dereference

A vulnerability was identified in BehaviorTree up to 4.7.0. This vulnerability affects the function XMLParser::PImpl::loadDocImpl of the file /src/xmlparsing.cpp of the component XML Parser. The manipulation leads to null pointer dereference. The attack can only be performed from a local...

CVE-2025-36857 Rapid7 Appspider Broken Access Control Vulnerability

Rapid7 Appspider Pro versions below 7.5.021, suffer from a broken access control vulnerability in the application's configuration file loading mechanism, whereby an attacker can place files in directories belonging to other users or projects. Affected versions allow standard users to add custom...

Linux Distros Unpatched Vulnerability : CVE-2025-9905

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Keras Model.loadmodel method can be exploited to achieve arbitrary code execution, even with safemode=True. One can create a specially crafted .h5/.hdf5 mod...

Linux Distros Unpatched Vulnerability : CVE-2022-50376

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - orangefs: Fix kmemleak in orangefskernel,clientdebuginit When insert and remove the orangefs module, there are memory leaked as below: unreferenced object...

CVE-2025-59582

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Darren Cooney Ajax Load More ajax-load-more allows Retrieve Embedded Sensitive Data.This issue affects Ajax Load More: from n/a through = 7.6.0.2...

CVE-2025-56816

Datart 1.0.0-rc.3 is vulnerable to Directory Traversal. The configuration file handling of the application allows attackers to upload arbitrary YAML files to the config/jdbc-driver-ext.yml path. The application parses this file using SnakeYAML's unsafe load or loadAs method without input...

CVE-2025-10906 Magnetism Studios Endurance NSXPC com.MagnetismStudios.endurance.helper loadModuleNamed:WithReply missing authentication

A flaw has been found in Magnetism Studios Endurance up to 3.3.0 on macOS. This affects the function loadModuleNamed:WithReply of the file /Applications/Endurance.app/Contents/Library/LaunchServices/com.MagnetismStudios.endurance.helper of the component NSXPC Interface. Executing manipulation can...

CVE-2025-10906

CVE-2025-10906 affects Magnetism Studios Endurance on macOS (versions up to 3.3.0). The vulnerability lies in the NSXPC Interface, specifically loadModuleNamed:WithReply in /Applications/Endurance.app/Contents/Library/LaunchServices/com.MagnetismStudios.endurance.helper, enabling local manipulati...

CVE-2025-56816

Datart 1.0.0-rc.3 is vulnerable to Directory Traversal via uploading YAML to config/jdbc-driver-ext.yml, parsed with SnakeYAML unsafe load/loadAs. This allows attacker-controlled YAML deserialization, potentially enabling remote code execution (RCE) under certain conditions. Exploitation details ...

CVE-2025-56816

Datart 1.0.0-rc.3 is vulnerable to Directory Traversal. The configuration file handling of the application allows attackers to upload arbitrary YAML files to the config/jdbc-driver-ext.yml path. The application parses this file using SnakeYAML's unsafe load or loadAs method without input...