CVE-2025-9358

CVE-2025-9358 affects Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 (firmware ranges listed in sources). The root cause is a stack-based buffer overflow in the setSysAdm function located in /goform/setSysAdm, triggered by manipulation of the admpasshint argument. This allows remote ex...

Fedora 42 : glab (2025-b597c89f32)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-b597c89f32 advisory. Update to 1.67.0 ---- Update to 1.66.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

PT-2025-34593 · Undefined · Undefined

CVE-2025-24468 - Apache HTTP Server Cross-Site Request Forgery CVE ID : CVE-2025-24468 Published : Aug. 23, 2025, 3:15 a.m. | 1 hour, 3 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and...

SUSE CVE-2025-38644

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject TDLS operations when station is not associated syzbot triggered a WARN in ieee80211tdlsoper by sending NL80211TDLSENABLELINK immediately after NL80211CMDCONNECT, before association completed and without pri...

CVE-2025-38666

In the Linux kernel, the following vulnerability has been resolved: net: appletalk: Fix use-after-free in AARP proxy probe The AARP proxy‐probe routine aarpproxyprobenetwork sends a probe, releases the aarplock, sleeps, then re-acquires the lock. During that window an expire timer thread...

CVE-2024-48988 Apache StreamPark: SQL injection vulnerability

SQL Injection vulnerability in Apache StreamPark. This issue affects Apache StreamPark: from 2.1.4 before 2.1.6. Users are recommended to upgrade to version 2.1.6, which fixes the issue. This vulnerability is present only in the distribution package SpringBoot platform and does not involve Maven...

curl: Missing Security Headers

Missing Security Headers Low Target: https://curl.se/ OWASP Mapping: A05 Misconfiguration / A02 Crypto Vulnerability ID: sec-headers-0f70ef5bcb Description A Missing Security Headers issue was discovered. This may allow an attacker to exploit the application. Proof of Concept Using cURL bash curl...

CVE-2025-38644

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject TDLS operations when station is not associated syzbot triggered a WARN in ieee80211tdlsoper by sending NL80211TDLSENABLELINK immediately after NL80211CMDCONNECT, before association completed and without pri...

AZL-66581 CVE-2025-38644 affecting package kernel for versions less than 6.6.104.2-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject TDLS operations when station is not associated syzbot triggered a WARN in ieee80211tdlsoper by sending NL80211TDLSENABLELINK immediately after NL80211CMDCONNECT, before association completed and without pri...

CVE-2025-38644 wifi: mac80211: reject TDLS operations when station is not associated

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject TDLS operations when station is not associated syzbot triggered a WARN in ieee80211tdlsoper by sending NL80211TDLSENABLELINK immediately after NL80211CMDCONNECT, before association completed and without pri...

CVE-2025-38644

CVE-2025-38644 is a Linux kernel issue in the MAC80211 Wi‑Fi code. When a station not yet associated sent NL80211_TDLS_ENABLE_LINK, TDLS was processed before association, leaving sdata->u.mgd.tdls_peer uninitialized and triggering a WARN_ON() in code paths that expected a valid TDLS peer. The ...

CVE-2025-38644

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject TDLS operations when station is not associated syzbot triggered a WARN in ieee80211tdlsoper by sending NL80211TDLSENABLELINK immediately after NL80211CMDCONNECT, before association completed and without pri...

CVE-2025-38644 wifi: mac80211: reject TDLS operations when station is not associated

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject TDLS operations when station is not associated syzbot triggered a WARN in ieee80211tdlsoper by sending NL80211TDLSENABLELINK immediately after NL80211CMDCONNECT, before association completed and without pri...

CVE-2025-54014

Deserialization of Untrusted Data vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Object Injection.This issue affects MediCenter - Health Medical Clinic: from n/a through = 15.1...

CVE-2025-54735

Incorrect Privilege Assignment vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Privilege Escalation.This issue affects CubeWP: from n/a through = 1.1.24...

Open Redirect

Amendment This was deemed not a vulnerability. Overview org.webjars.npm:koa is a Koa web app framework Affected versions of this package are vulnerable to Open Redirect via the redirect function in lib/response.js due to improper input sanitization. An attacker can redirect users to arbitrary...

MAL-2025-41271 Malicious code in apollo-ms (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d475a426c61513aa519a888a0b2e6968223fdcf3b3ea86c39f8bd0777207c40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fedora 43 : docker-buildx (2025-f2bcb1f99e)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-f2bcb1f99e advisory. Automatic update for docker-buildx-0.27.0-1.fc43. Changelog Wed Aug 20 2025 Bradley G Smith - 0.27.0-1 - Update to release v0.27.0 - Resolves: rhvz2388453,...

PT-2025-34343 · Uniong · Webitr

Name of the Vulnerable Software and Affected Versions: WebITR versions affected versions not specified Description: WebITR developed by Uniong is susceptible to an arbitrary file reading issue. This allows remote attackers with regular privileges to exploit an Absolute Path Traversal flaw to...

CVE-2025-55734

flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, the code checks if the userRole is "admin" only when visiting the /admin page, but not when visiting its subroutes. Specifically, only the file routes/adminPanel.py checks the user role when a user is trying to access the admin page,...