Linux kernel mm/hugetlb DoS

The vulnerability of Linux kernel’s mm/hugetlb components is related to exception handling deficiencies. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2025-23459 · Imagination Technologies +1 · Graphics Ddk +1

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue allows software installed and run as a non-privileged user to conduct improper GPU system calls, which can subvert GPU hardware to write to arbitrary physical memory pages...

📄 Motivian Content Management System 41.0.0 Cross Site Scripting

Motivian Content Management System version 41.0.0 suffers from multiple cross site scripting vulnerabilities. CVE-2025-29094-Multiple-Stored-Cross-Site-Scripting-XSS This repository reveals a security vulnerability discovered in Motivian Content Management System v.41.0.0. - CVE-2025-29094:...

CVE-2025-48885

application-urlshortener create shortened URLs for XWiki pages. Versions prior to 1.2.4 are vulnerable to users with view access being able to create arbitrary pages. Any user even guests can create these docs, even if they don't exist already. This can enable guest users to denature the structur...

CVE-2025-48885

application-urlshortener create shortened URLs for XWiki pages. Versions prior to 1.2.4 are vulnerable to users with view access being able to create arbitrary pages. Any user even guests can create these docs, even if they don't exist already. This can enable guest users to denature the structur...

CVE-2025-48885 application-urlshortener users can create arbitrary pages as long as they have view access to them

application-urlshortener create shortened URLs for XWiki pages. Versions prior to 1.2.4 are vulnerable to users with view access being able to create arbitrary pages. Any user even guests can create these docs, even if they don't exist already. This can enable guest users to denature the structur...

CVE-2025-48885 application-urlshortener users can create arbitrary pages as long as they have view access to them

application-urlshortener create shortened URLs for XWiki pages. Versions prior to 1.2.4 are vulnerable to users with view access being able to create arbitrary pages. Any user even guests can create these docs, even if they don't exist already. This can enable guest users to denature the structur...

HackerOne: Residual Malicious Payloads on HackerOne after Vulnerability Fixes

A vulnerability was previously discovered on the HackerOne platform that allowed users to add malicious payloads to their profile pages. Despite remediation efforts, some of these malicious payloads were not fully removed from user profiles. This situation meant that the malicious content could...

application-urlshortener Cross-Site Request Forgery Vulnerability

application-urlshortener is an open source XWiki SAS tool for creating shortened URLs for XWiki pages. A cross-site request forgery vulnerability exists in versions of application-urlshortener prior to 1.2.4, where a user with view privileges can create arbitrary pages...

Mautic's Predictable Page Indexing Might Lead to Sensitive Data Exposure

Summary This advisory addresses a security vulnerability in Mautic where unpublished page previews could be accessed by unauthenticated users and potentially indexed by search engines. This could lead to the unintended disclosure of draft content or sensitive information. Unauthorized Access to...

TeleMessage security vulnerabilities

TeleMessage is a secure and compliant messaging solution for organizations from TeleMessage Israel. A security vulnerability exists in TeleMessage version 2025-05-05 and earlier, which stems from the heap content of a JSP application containing a password sent over HTTP...

CVE-2025-5267 Clickjacking vulnerability could have led to leaking saved payment card details

A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerability was fixed in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11...

thunderbird: Tracking Links in Attachments Bypassed Remote Content Blocking

The Mozilla Foundation's Security Advisory describes the following issue: It is possible to craft an email that shows a tracking link as an attachment. If the user attempts to open the attachment, Thunderbird automatically accesses the link. The configuration to block remote content does not...

Russian Hackers Breach 20+ NGOs Using Evilginx Phishing via Fake Microsoft Entra Pages

Microsoft has shed light on a previously undocumented cluster of malicious activity originating from a Russia-affiliated threat actor dubbed Void Blizzard aka Laundry Bear that it said is attributed to "worldwide cloud abuse." Active since at least April 2024, the hacking group is linked to...

Employees Searching Payroll Portals on Google Tricked Into Sending Paychecks to Hackers

Threat hunters have exposed a novel campaign that makes use of search engine optimization SEO poisoning techniques to target employee mobile devices and facilitate payroll fraud. The activity, first detected by ReliaQuest in May 2025 targeting an unnamed customer in the manufacturing sector, is...

CampCodes Sales and Inventory System SQL Injection Vulnerability

CampCodes Sales and Inventory System is a sales and inventory system from CampCodes, Inc. CampCodes Sales and Inventory System suffers from a SQL injection vulnerability that stems from the improper handling of the cid parameter in the file /pages/payment.php, no details of the vulnerability are...

MagicINFO 9 Code Execution

The vulnerability of the HttpServletRequest.getParameter function in the MagicINFO 9 centralized multimedia content management system is related to the improper creation of a file system path by combining a permanent directory, a temporary marker, and the fileName parameter. Exploiting this...

GHSA-5R4R-9FGH-PW53 memory_pages division by zero

In the memorypages crate 0.1.0 for Rust, division by zero can occur...

CVE-2025-48754

In the memorypages crate 0.1.0 for Rust, division by zero can occur...

memory_pages numerical error vulnerability

memorypages is a small library from the Fractal Fir individual developers that provides a cross-platform API for requesting pages from the kernel under certain prerequisites. A numeric error vulnerability exists in memorypages version 0.1.0, which stems from a possible divide-by-zero error...