MAL-2025-28204 Malicious code in old-throw-chi-boolean-slow (npm)

The package old-throw-chi-boolean-slow was found to contain malicious code...

MAL-2025-20581 Malicious code in fire-error-pipe-delta-old (npm)

The package fire-error-pipe-delta-old was found to contain malicious code...

CVE-2023-5342

The Fedora Secure Boot CA certificate shipped with shim in Fedora was expired which could lead to old or invalid signed boot components being loaded...

CVE-2025-8046

The CVE-2025-8046 entry is confirmed with concrete details: Injection Guard WordPress plugin versions prior to 1.2.8 do not escape $_SERVER['REQUEST_URI'] when echoing in an HTML attribute, enabling Reflected XSS in older browsers. Affected software: Injection Guard WordPress plugin

WordPress plugin Build App Online 跨站请求伪造漏洞

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in WordPress plugin Build App Online 1.0.23 and prior...

PT-2025-37952

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the drm/mediatek subsystem related to handling of the old state-crtc after a hotplug event. Specifically, a lack of error handling can lead to a kerne...

Adobe Dimension < 4.1.4 Memory leak (APSB25-84)

The version of Adobe Dimension installed on the remote Windows host is prior to 4.1.4. It is, therefore, affected by a vulnerability as referenced in the APSB25-84 advisory. - Out-of-bounds Read CWE-125 potentially leading to Memory leak CVE-2025-54238 Note that Nessus has not tested for this iss...

Catalyst::Authentication::Credential::HTTP 安全漏洞

Catalyst::Authentication::Credential::HTTP is a Catalyst open source HTTP basic and digest authentication library. A security vulnerability exists in Catalyst::Authentication::Credential::HTTP version 1.018 and earlier that stems from the use of a non-strongly encrypted source to generate a nonce...

Linux Distros Unpatched Vulnerability : CVE-2025-21989

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix missing .istwopixelspercontainer Starting from 6.11, AMDGPU driver, whi...

Linux Distros Unpatched Vulnerability : CVE-2023-52897

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: do not warn on record without oldroots populated BUG There are some reports...

CVE-2025-54999 OpenBao: Timing Side-Channel in Userpass Auth Method

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, when using OpenBao's userpass auth method, user enumeration was possible due to timing difference between non-existent users an...

Linux Distros Unpatched Vulnerability : CVE-2025-38287

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: IB/cm: Drop lockdep assert and WARN when freeing old msg The send completion handler can run...

Linux Distros Unpatched Vulnerability : CVE-2025-38158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: hisiaccvfiopci: fix XQE dma address error The dma addresses of EQE and AEQE are wrong after...

CVE-2025-38227 affecting package kernel for versions less than 6.6.96.1-1

CVE-2025-38227 affecting package kernel for versions less than 6.6.96.1-1. A patched version of the package is available...

CVE-2025-8217 Inert Malicious script injected into Amazon Q Developer Visual Studio Code (VS Code) Extension

The Amazon Q Developer Visual Studio Code VS Code extension v1.84.0 contains inert, injected code designed to call the Q Developer CLI. The code executes when the extension is launched within the VS Code environment; however the injected code contains a syntax error which prevents it from making ...

Tenda CH22 formdeleteUserName function buffer overflow vulnerability

Tenda CH22 is an enterprise-grade wireless router from Tenda. The Tenda CH22 suffers from a buffer overflow vulnerability that originates from the formdeleteUserName function in the /goform/deleteUserName file improperly handling the oldaccount parameter. An attacker can exploit this vulnerabilit...

The vulnerability of the formdeleteUserName() function in the Tenda CH22 router software allows a hacker to cause a service failure.

The vulnerability of the formdeleteUserName function in the Tenda CH22 router software lies in the copying of buffers without checking the size of the input data when processing the oldaccount parameter. Exploiting this vulnerability could allow an attacker to cause service interruptions remotely...

CVE-2025-8180

A vulnerability, which was classified as critical, has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function formdeleteUserName of the file /goform/deleteUserName. The manipulation of the argument oldaccount leads to buffer overflow. The attack may be launched remotely. The...

Tenda CH22 安全漏洞

Tenda CH22 is an enterprise-grade wireless router from Tenda. The Tenda CH22 suffers from a buffer overflow vulnerability that originates from the formdeleteUserName function in the /goform/deleteUserName file improperly handling the oldaccount parameter. An attacker can exploit this vulnerabilit...

PT-2025-33585

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A device refcount leak exists in the atrtr create function when updating an existing route entry. The old device reference was not released before assigning the new device, resulting i...