WordPress Paid Member Subscriptions plugin <= 2.15.1 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by ChuongVN in WordPress Plugin Paid Member Subscriptions versions = 2.15.1...

CVE-2025-38146

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix the dead loop of MPLS parse The unexpected MPLS packet may not end with the bottom label stack. When there are many stacks, The label count value has wrapped around. A dead loop occurs, soft lockup/CPU stuck...

CVE-2025-38172

In the Linux kernel, the following vulnerability has been resolved: erofs: avoid using multiple devices with different type For multiple devices, both primary and extra devices should be the same type. erofsinitdevice has already guaranteed that if the primary is a file-backed device, extra devic...

CVE-2025-38094

In the Linux kernel, the following vulnerability has been resolved: net: cadence: macb: Fix a possible deadlock in macbhalttx. There is a situation where after THALT is set high, TGO stays high as well. Because jiffies are never updated, as we are in a context with interrupts disabled, we never...

Cross-site Scripting (XSS)

Overview org.webjars.bowergithub.uikit:uikit is a lightweight and modular front-end framework for developing fast and powerful web interfaces. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the data-caption attribute due to insufficient input sanitisation and outp...

PT-2025-27803 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 15.03.05.16 multi Description: The issue concerns a Buffer Overflow in the formSetQosBand function via the list parameter. This occurs in the context of QoS configuration. Recommendations: For Tenda AC6 version 15.03.05.16...

CVE-2025-34090

A security bypass flaw was found in Google Chrome. A local low-privileged attacker can hijack the COM class identifier registration used by Chrome's elevation service and point it to a non-existent or malicious binary. When this hijack occurs, Chrome silently falls back to the legacy cookie...

CVE-2025-34092

A cookie encryption bypass flaw was found in Google Chrome. When Chrome encrypts a cookie key, it records its executable path as validation metadata. Later, when decrypting, the elevation service compares the requesting process’s path to this stored path. However, due to path canonicalization...

CVE-2025-34075

A virtual machine escape vector has been discovered in HashiCorp Vagrant. By design, Vagrant automatically mounts the host system’s project directory into the guest VM under /vagrant. This includes the Vagrantfile configuration file, which is a Ruby script evaluated by the host every time a vagra...

CVE-2025-52891

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least...

CVE-2025-24332

Nokia Single RAN AirScale baseband allows an authenticated administrative user access to all physical boards after performing a single login to the baseband system board. The baseband does not re-authenticate the user when they connect from the baseband system board to the baseband capacity board...

CVE-2025-24332 Authenticated admin user can connect baseband internally from one board to another without needing to re-authentication

Nokia Single RAN AirScale baseband allows an authenticated administrative user access to all physical boards after performing a single login to the baseband system board. The baseband does not re-authenticate the user when they connect from the baseband system board to the baseband capacity board...

CVE-2025-24332

Nokia Single RAN AirScale baseband prior to 23R4-SR 3.0 MP is affected. An authenticated administrative user can move laterally across baseband boards via the internal bsoc SSH over the baseband backplane, using an SSH private key on the baseband system board, without re-authentication. This effe...

CVE-2025-24332 Authenticated admin user can connect baseband internally from one board to another without needing to re-authentication

Nokia Single RAN AirScale baseband allows an authenticated administrative user access to all physical boards after performing a single login to the baseband system board. The baseband does not re-authenticate the user when they connect from the baseband system board to the baseband capacity board...

PT-2025-27658 · Unknown · Secret Server

Name of the Vulnerable Software and Affected Versions: Secret Server versions 11.7.49 and earlier Description: The distributed engine of Secret Server can be exploited during an initial authorization event, allowing an attacker to impersonate another distributed engine. Recommendations: For Secre...

PT-2025-27662 · Enensys · Enensys Ipguard

Name of the Vulnerable Software and Affected Versions: ENENSYS IPGuard v2 version 2.10.0 Description: The issue concerns hardcoded credentials in the software. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world inciden...

CVE-2025-53103

An information disclosure flaw was found in JUnit. When writing Open Test Reporting XML files, git credentials may be leaked. The full impact of this flaw depends on how these XML files are handled on a per-environment basis. Mitigation Mitigation for this issue is either not available or the...

CVE-2025-6297

A temporary file cleanup flaw was found in dpkg. When extracting a control member into a temporary directory, the code responsible for cleaning up the temporary directory does not sanitize the directory permissions, leaving temporary files behind. Repeated and automated execution of dpkg-deb...

CVE-2024-46993

A flaw was found in Electron. The nativeImage.createFromPath and nativeImage.createFromBuffer functions contain a heap buffer overflow triggered by processing excessively large image data. This flaw allows a local attacker to trigger this overflow by providing a specially crafted image file or...

CVE-2024-46992

A flaw was found in Electron. The vulnerability stems from improper handling of ASAR Archive files, allowing a local attacker to manipulate archive contents without proper integrity verification. This issue can lead to arbitrary code execution within the application's context via a crafted ASAR...