CVE-2025-40261

In the Linux kernel, the following vulnerability has been resolved: nvme: nvme-fc: Ensure -ioerrwork is cancelled in nvmefcdeletectrl nvmefcdeleteassocation waits for pending I/O to complete before returning, and an error can cause -ioerrwork to be queued after cancelworksync had been called. Mov...

EUVD-2025-201157

In the Linux kernel, the following vulnerability has been resolved: xfrm: delete x-tunnel as we delete x The ipcomp fallback tunnels currently get deleted from the various lists and hashtables as the last user state that needed that fallback is destroyed not deleted. If a reference to that user...

Insecure Direct Object Reference (IDOR)

com.liferay.commerce, com.liferay.commerce.order.content.web is vulnerable to Insecure Direct Object Reference IDOR. The vulnerability is due to improper access control on the CommerceOrderPortletcommerceOrderId parameter, which allows an attacker to access shipment addresses from other virtual...

PT-2026-38935

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the wave5 driver when operating in polling mode. The driver uses an hrtimer to periodically trigger the wave5 vpu timer callback function, which queues work vi...

PT-2025-49075

Name of the Vulnerable Software and Affected Versions platform version 1.0.0 Description An issue with access control exists in the orderService.queryObject component. This allows attackers to access sensitive information by sending a specially crafted request. The affected component is...

Weitong Mall security vulnerability

Weitong Mall 微同商城 is a shopping mall system by fuyanglipengjun, an individual developer. A security vulnerability exists in Weitong Mall version 1.0.0, which originates from improper access control of the ApiOrderService.java component, and may result in the disclosure of sensitive information...

EUVD-2025-201240

Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensitive information via a crafted request...

CVE-2025-57213

CVE-2025-57213 affects platform v1.0.0. The vulnerability arises from incorrect access control in the component orderService.queryObject, enabling an attacker to access sensitive information via a crafted request. Current documents do not specify the affected software family beyond platform v1.0....

PT-2026-2616

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A crash issue exists within the Linux kernel's networking subsystem, specifically in the stmmac driver when utilizing zero copy XDP TX actions. The issue stems from an incorrect memory...

PT-2025-49074

Name of the Vulnerable Software and Affected Versions platform version 1.0.0 Description An access control issue exists in the ApiOrderService.java component, potentially allowing unauthorized access to sensitive information through a specially crafted request. Recommendations Apply updates to...

PT-2026-37569

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the wave5 media driver where an incorrect device cleanup order can lead to a kernel panic during encoding operations. In polling mode, the wave5 vpu timer callback...

CVE-2025-57212

CVE-2025-57212 affects platform v1.0.0 in the ApiOrderService.java component, where improper access control may allow an attacker to disclose sensitive information via a crafted request. Evidence across multiple sources confirms the same description without additional exploit details. The vulnera...

Weitong Mall security vulnerability

Weitong Mall 微同商城 is a shopping mall system by fuyanglipengjun, an individual developer. A security vulnerability exists in Weitong Mall version 1.0.0, which originates from improper access control of the orderService.queryObject component, which may lead to sensitive information leakage...

EUVD-2025-201239

Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive information via a crafted request...

CVE-2025-57213

Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensitive information via a crafted request...

CVE-2025-57213

Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensitive information via a crafted request...

WordPress Order Delivery Date for WooCommerce plugin <= 4.3.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Order Delivery Date for WooCommerce versions = 4.3.1...

kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path

A use-after-free vulnerability exists in the linux kernel such that the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock...

Moderate: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

📄 phpIPAM 1.4 SQL Injection

phpIPAM version 1.4 suffers from a remote SQL injection vulnerability in order.php. This version is also known to suffer from other vectors of attack for the same issue. Exploit Title: phpIPAM 1.4 - SQL Injection Date: 2025-11-25 Exploit Author: CodeSecLab Vendor Homepage:...