CVE-2025-38512

In the Linux kernel, the following vulnerability has been resolved: wifi: prevent A-MSDU attacks in mesh networks This patch is a mitigation to prevent the A-MSDU spoofing vulnerability for mesh networks. The initial update to the IEEE 802.11 standard, in response to the FragAttacks, missed this...

CVE-2025-38508

The CVE-2025-38508 entry describes a Linux kernel vulnerability in x86/SEV: when Secure TSC is enabled, GUEST_TSC_FREQ is derived from the P0 frequency and diverges from the mean TSC frequency, causing clock skew in SEV-SNP VMs and resulting in hrtimer interrupts firing earlier than expected. The...

WordPress WPGYM - Wordpress Gym Management System plugin <= 67.7.0 - Authenticated (Subscriber+) Local File Inclusion to Privilege Escalation via Password Update vulnerability

WordPress WPGYM - Wordpress Gym Management System plugin = 67.7.0 - Authenticated Subscriber+ Local File Inclusion to Privilege Escalation via Password Update vulnerability discovered by WordFence in WordPress Plugin WPGYM versions = 67.7.0...

CVE-2025-8959

A flaw was found in HashiCorp’s go-getter library subdirectory download feature, where it is vulnerable to symlink attacks. This vulnerability can lead to unauthorized read access beyond the designated directory boundaries. Mitigation Mitigation for this issue is either not available or the...

CVE-2024-5477

A potential security vulnerability has been identified in the System BIOS for some HP PC products which may allow escalation of privilege, arbitrary code execution, denial of service, or information disclosure via a physical attack that requires specialized equipment and knowledge. HP is releasin...

CVE-2025-55285

A flaw has been discovered in the @backstage/plugin-scaffolder-backend npm package that can lead to an information leak. The fetch:template action in the Scaffolder improperly duplicates logging of input values, which can bypass the intended redaction of secrets. This means that an attacker with...

CVE-2025-54989

Firebird is a relational database. Prior to versions 3.0.13, 4.0.6, and 5.0.3, there is an XDR message parsing NULL pointer dereference denial-of-service vulnerability in Firebird. This specific flaw exists within the parsing of xdr message from client. It leads to NULL pointer dereference and Do...

CVE-2025-24975

A flaw has been discovered in the Firebird SQL project that can lead to an access bypass. If connections stored in the ExtConnPool are not properly verified for the CryptCallback interface upon creation, it could cause a server process segmentation fault. This vulnerability could allow an...

CVE-2025-9019

A flaw was found in tcpreplay. The maskcidr6 function in cidr.c contains a heap-based buffer overflow triggered by manipulation of network packets. A remote attacker can initiate the overflow by providing a specially crafted packet. This buffer overflow can lead to an application level denial of...

CVE-2025-50518

A flaw was found in libcoap. The coapdeletepdulkd function in coappdu.c exhibits a use-after-free condition due to improper memory management following the deallocation of a Packet Data Unit PDU object. This can allow a local attacker to trigger memory corruption. Exploitation occurs when a freed...

CVE-2025-50817

An unintended import flaw was found in the PyPI future package. When the module is loaded, it automatically imports test.py if present in the same directory or the sys.path. This behavior allows an attacker who can write files to the server to execute arbitrary code. Mitigation Mitigation for thi...

CVE-2025-8715

A flaw was found in PostgreSQL. This vulnerability allows a malicious user of the PostgreSQL server to inject arbitrary code in dump files created by pgdump, pgdumpall, pgrestore, and pgupgrade, causing arbitrary code execution on the client machine or SQL injection when these dump files are...

CVE-2025-8714

A flaw was found in PostgreSQL. This vulnerability allows a malicious superuser on a PostgreSQL server to inject arbitrary code into dump files created by pgdump, pgdumpall, and pgrestore, causing arbitrary code execution on the client machine when these dump files are restored by psql due to...

CVE-2025-8713

PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this...

CVE-2025-8961

A memory corruption flaw was found in libTIFF. This issue affects the May function of the tiffcrop.c file in the tiffcrop component. This attack needs to be approached locally. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

WordPress WP Pipes Plugin <= 1.4.3 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by LVT-tholv2k in WordPress Plugin WP Pipes versions = 1.4.3...

CVE-2025-50946

A flaw was found in github.com/olivetin/olivetin. The ParseRequestURI function in service/internal/executor/arguments.go is vulnerable to an OS command injection, allowing an attacker to execute arbitrary commands on the system. This occurs when processing a crafted URI. A remote attacker can...

Rockwell Automation ControlLogix Ethernet Modules

RISK EVALUATION Successful exploitation of this vulnerability could allow remote attackers to perform memory dumps, modify memory, and control execution flow. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such...

CVE-2025-55668

A session fixation vulnerability has been identified in Apache Tomcat, affecting its rewrite functionality. If the rewrite valve is enabled for a web application, an attacker can craft a specific URL. If a victim clicks on this malicious URL, their subsequent interaction with the resource will...

CVE-2025-53859

A memory access flaw has been discovered in nginx. The ngxmailsmtpmodule might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory. As a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue occurs during th...