CVE-2025-27188 Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access...

EUVD-2025-11917

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user resulting in a High impact to Confidentiality and Integrity. Exploitation of this issue does...

CVE-2025-30286

CVE-2025-30286 affects Adobe ColdFusion—versions 2023.12, 2021.18, 2025.0 and earlier—with an OS Command Injection vulnerability that could enable arbitrary code execution by a high-privilege attacker, requiring user interaction. The root cause is improper neutralization of special elements used ...

CVE-2025-22009

In the Linux kernel, the following vulnerability has been resolved: regulator: dummy: force synchronous probing Sometimes I get a NULL pointer dereference at boot time in kobjectget with the following call stack: anatopregulatorprobe devmregulatorregister regulatorregister regulatorresolvesupply...

CVE-2025-31333

SAP S4CORE OData meta-data property is vulnerable to data tampering, due to which entity set could be externally modified by an attacker causing low impact on integrity of the application. Confidentiality and availability is not impacted...

PT-2025-15559 · Microsoft · Windows Power Dependency Coordinator +1

Name of the Vulnerable Software and Affected Versions: Windows Power Dependency Coordinator affected versions not specified Description: The issue allows an authorized attacker to disclose sensitive information locally due to the exposure of sensitive information to an unauthorized actor...

Adobe Commerce 访问控制错误漏洞

Adobe Commerce is a leading global digital commerce solution for merchants and brands. Adobe Commerce suffers from an Access Control Error vulnerability that stems from improper access control, and no detailed vulnerability details are available at this time...

PT-2025-15319 · Isherlock · Isherlock

Name of the Vulnerable Software and Affected Versions: iSherlock affected versions not specified Description: The iSherlock web service has an issue that allows remote attackers to inject and execute arbitrary system commands on the server. This is possible due to an OS command injection flaw,...

PT-2025-15562 · Microsoft · Windows Kernel +1

Name of the Vulnerable Software and Affected Versions: Windows Kernel affected versions not specified Description: The issue is related to an untrusted pointer dereference in the Windows Kernel, allowing an authorized attacker to elevate privileges locally. Recommendations: At the moment, there i...

GHSA-RR8G-9FPQ-6WMG Tokio broadcast channel calls clone in parallel, but does not require `Sync`

The broadcast channel internally calls clone on the stored value when receiving it, and only requires T:Send. This means that using the broadcast channel with values that are Send but not Sync can trigger unsoundness if the clone implementation makes use of the value being !Sync. Thank you to...

UBUNTU-CVE-2025-29479

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Broadcast channel calls clone in parallel, but does not require `Sync`

The broadcast channel internally calls clone on the stored value when receiving it, and only requires T:Send. This means that using the broadcast channel with values that are Send but not Sync can trigger unsoundness if the clone implementation makes use of the value being !Sync. Thank you to...

RUSTSEC-2025-0023 Broadcast channel calls clone in parallel, but does not require `Sync`

The broadcast channel internally calls clone on the stored value when receiving it, and only requires T:Send. This means that using the broadcast channel with values that are Send but not Sync can trigger unsoundness if the clone implementation makes use of the value being !Sync. Thank you to...

CVE-2025-20656

In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09625423...

Malicious code in byted-midas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c6dc2f04495ba96914b9d781f935e6e0b4e6e610e7b15cf3b603079b0895b9df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-20656

In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09625423...

Malicious code in boss-ui-ats (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4aa5d2f568d0db7a56731ab67f01754428ac6deeb365683b5fd0ab8a598c26f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

libxslt: Use-After-Free in libxslt numbers.c

A flaw was found in libxslt numbers.c. This vulnerability allows a use-after-free, potentially leading to memory corruption or code execution via nested XPath evaluations where an XPath context node can be modified but not restored...

Amazon AWS CloudFormation Templates Uncontrolled Search Path Element Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Amazon AWS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the installation of AWS Simple Storage Service. When installed from the official GitHub...

PT-2025-15077 · Code Projects · Patient Record Management System

Name of the Vulnerable Software and Affected Versions: code-projects Patient Record Management System version 1.0 Description: A critical issue was found in the Patient Record Management System. This issue affects an unknown part of the file /dental not.php. The manipulation of the itr no argumen...