CVE-2025-26424

In multiple functions of VpnManager.java, there is a possible cross-user data leak due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-38707

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add sanity check for file name The length of the file name should be smaller than the directory entry size...

CVE-2025-7385

Input from search query parameter in GOV CMS is not sanitized properly, leading to a Blind SQL injection vulnerability, which might be exploited by an unauthenticated remote attacker. Versions 4.0 and above are not affected...

CVE-2025-36901

WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396462223...

CVE-2025-36904

CVE-2025-36904 maps to a WLAN elevation-of-privilege issue on Google Pixel devices. Connected OSV data describes a Broadcom Wi‑Fi driver vulnerability in wl_android_get_best_channels, an out-of-bounds write caused by unvalidated list->count. The Pixel bulletin indicates updating to 2025-09-05 ...

CVE-2025-58057

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted...

md: Don't register sync_thread for reshape directly

...

PT-2025-35937

Name of the Vulnerable Software and Affected Versions: GOV CMS versions prior to 4.0 Description: The input from the search query parameter in GOV CMS is not properly sanitized, leading to a Blind SQL injection. This could be exploited by an unauthenticated remote attacker. Recommendations: Ensur...

crypto: starfive - Do not free stack buffer

...

drm/amd/display: Skip pipe if the pipe idx not set properly

...

CVE-2025-7974 rocket.chat Incorrect Authorization Information Disclosure Vulnerability

rocket.chat Incorrect Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of rocket.chat. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web...

Fuji Electric FRENIC-Loader 4

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control...

Linux Distros Unpatched Vulnerability : CVE-2024-53427

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflo...

Linux Distros Unpatched Vulnerability : CVE-2022-42258

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer nvidia.ko, where an integer overflow may lead to denial of service, data...

Linux Distros Unpatched Vulnerability : CVE-2025-38644

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mac80211: reject TDLS operations when station is not associated syzbot triggered a WARN in ieee80211tdlsoper by sending NL80211TDLSENABLELINK immediately...

Linux Distros Unpatched Vulnerability : CVE-2020-35662

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated. CVE-2020-35662 Note that...

Linux Distros Unpatched Vulnerability : CVE-2018-7184

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the received timestamp, which allows remote attackers to cause a denial of service...

Linux Distros Unpatched Vulnerability : CVE-2025-38628

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix release of uninitialized resources on error path The commit in the fixes tag...

CVE-2024-12914 XSS in Akinsoft's QR Menu

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Akınsoft QR Menü allows Cross-Site Scripting XSS. This issue affects QR Menü: from s1.05.05 before v1.05.12...

MAL-2025-42134 Malicious code in polyfliof92 (npm)

The package polyfliof92 was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4387ae12209d330b510d4b61ae05eaed4bf1771880ccf8f8df83711e29b6a0e8 Any computer that has this package installed or running should be considered fully...