Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R --chroot option to run arbitrary commands as root, even if they are not listed in the sudoers file...

MINI-4X32-M3FV-M3GR

Bulletin has no description...

SUSE-SU-2025:03413-1 Security update for the Linux Kernel (Live Patch 2 for SLE 15 SP7)

This update for the Linux Kernel 6.4.0-150700536 fixes several issues. The following security issues were fixed: - CVE-2025-38498: dochangetype: refuse to operate on unmounted/not ours mounts bsc1247499. - CVE-2025-38555: usb: gadget : fix use-after-free in compositedevcleanup bsc1248298...

PT-2025-39797

Name of the Vulnerable Software and Affected Versions Apeman ID71 affected versions not specified Description A security flaw exists in Apeman ID71 that involves hard-coded credentials. This allows for remote takeover of the device. The vulnerability resides in unknown code within the...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the dumpdwarfsection function. An attacker can cause a denial of service by providing specially crafted input that triggers an out-of-bounds read during processing. Remediation A fix was pushed into the master...

Nextcloud: WebAuthn app was updated based on public key

Vulnerability description not provided...

CVE-2025-11018

A flaw has been found in Four-Faith Water Conservancy Informatization Platform 1.0. This affects an unknown function of the file /sysRole/index.do/../../generalReport/download.do;usrlogout.do.do. Executing manipulation of the argument fileName can lead to path traversal. It is possible to launch...

PT-2025-49440

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the Bluetooth BCSP Bluetooth Core Specification Protocol component. Specifically, the bcsp recv function can be invoked even when the BCSP protoco...

CVE-2025-10961

A vulnerability was determined in Wavlink NU516U1 M16U1V240425. This affects the function sub4030C0 of the file /cgi-bin/wireless.cgi of the component DeleteMaclist Page. Executing manipulation of the argument deletelist can lead to command injection. The vendor was contacted early about this...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via the fromJson function. An attacker can cause a denial of service by providing a crafted argument to trigger a null pointer dereference. Remediation Upgrade behaviortree.cpp to version 4.9.0 or higher...

CVE-2025-10942

A vulnerability was identified in H3C Magic B3 up to 100R002. This affects the function AddMacList/EditMacList of the file /goform/aspForm. The manipulation of the argument param leads to buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used. T...

WordPress WP Subscription Forms PRO Plugin <= 2.0.5 - Arbitrary Content Deletion Vulnerability

Arbitrary Content Deletion Vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin WP Subscription Forms PRO versions = 2.0.5...

WordPress Javo Core Plugin <= 3.0.0.266 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Javo Core versions = 3.0.0.266...

CVE-2025-29157

An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via accessing a non-existent endpoint/cart, the server returns a 404-error page exposing sensitive information including the Servlet name default and server version...

CVE-2025-10989 yangzongzhuan RuoYi selectAll improper authorization

A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This vulnerability affects unknown code of the file /system/role/authUser/selectAll. Performing manipulation of the argument userIds results in improper authorization. The attack can be initiated remotely. The exploit has bee...

Stack-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Stack-based Buffer Overflow via improper handling of memory buffers in asnbuildobjid in lib/snmplib/asn1.c. An attacker can cause a denial of service by sending specially crafted input that triggers a buffer overflow. Remediation A fix...

PT-2025-39582

Name of the Vulnerable Software and Affected Versions Joovii Sendle Shipping versions through 6.02 Description A Cross-Site Request Forgery CSRF issue exists in Joovii Sendle Shipping. This allows attackers to perform actions on behalf of unsuspecting users. The issue allows Cross Site Request...

PT-2025-39810

CVE-2025-50879 - None CVE ID : CVE-2025-50879 Published : Sept. 26, 2025, 8:15 p.m. | 3 hours, 9 minutes ago Description : Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue...

PT-2025-39472

Name of the Vulnerable Software and Affected Versions roncoo-pay versions prior to 9428382af21cd5568319eae7429b7e1d0332ff40 Description An issue exists in roncoo-pay where manipulation of an unknown function within the /user/info/lookupList file can lead to improper authorization. This issue can ...

CVE-2025-10978

JeecgBoot up to 3.8.2 is affected. The vulnerability lies in the Filter Handler’s /sys/user/exportXls function, where improper authorization can be triggered remotely. Reports across multiple feeds state the exploit has been released publicly, with the vendor reportedly non-responsive. Affected v...