13655 matches found
CVE-2025-32421: Concurrent Execution using Shared Resource with Improper Synchronization
Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve pageProps data instead of standard HTML. Thi...
OXID eShop May Display User Information
An issue was discovered in OXID eShop before 7. CMS pages in combination with Smarty may display user information if a CMS page contains a Smarty syntax error...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure due to the improper handling of Smarty syntax errors in CMS pages. An attacker can expose sensitive user information by inducing a Smarty syntax error in a CMS page. Note: The official vendor's hotfix for this issue...
CVE-2024-56526
An issue was discovered in OXID eShop before 7. CMS pages in combination with Smarty may display user information if a CMS page contains a Smarty syntax error...
CVE-2024-56526
An issue was discovered in OXID eShop before 7. CMS pages in combination with Smarty may display user information if a CMS page contains a Smarty syntax error...
kernel: mm/swapfile: skip HugeTLB pages for unuse_vma
A flaw was found in the Linux kernel's memory management, specifically in how it handles HugeTLB Huge Transparent Large Block pages during the swapoff operation. A local user can trigger this by allocating anonymous HugeTLB memory, swapping out other anonymous memory, and then executing the swapo...
kernel: xfs: fix finding a last resort AG in xfs_filestream_pick_ag
In the Linux kernel, the following vulnerability has been resolved: xfs: fix finding a last resort AG in xfsfilestreampickag When the main loop in xfsfilestreampickag fails to find a suitable AG it tries to just pick the online AG. But the loop for that uses args-pag as loop iterator while the...
kernel: userfaultfd: fix checks for huge PMDs
A flaw was found in the Linux kernel's userfaultfd component. A local user could exploit a race condition in the handling of huge page table entries PMDs. This vulnerability can lead to a kernel crash, resulting in a Denial of Service DoS. In older kernel versions, this flaw could also potentiall...
kernel: mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()
In the Linux kernel, the following vulnerability has been resolved: mm: vmscan: account for free pages to prevent infinite Loop in throttledirectreclaim The task sometimes continues looping in throttledirectreclaim because allowdirectreclaimpgdat keeps returning false. 0 ffff80002cb6f8d0 switchto...
CVE-2024-56526
An issue was discovered in OXID eShop before 7. CMS pages in combination with Smarty may display user information if a CMS page contains a Smarty syntax error...
CVE-2024-56526
Versions of OXID eShop prior to 7 are vulnerable to information disclosure due to improper error handling. When used in combination with Smarty , a Smarty syntax error on a CMS page can cause the system to display sensitive user information . To remediate this, users are recommended to update to ...
CVE-2025-4502: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. This vulnerability affects unknown code of the file /pages/creditoradd.php. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the...
CampCodes Sales and Inventory System Injection Vulnerability
CampCodes Sales and Inventory System is a sales and inventory system from CampCodes, Inc. An injection vulnerability exists in CampCodes Sales and Inventory System version 1.0, which stems from SQL injection due to incorrect manipulation of the parameter ID in the file /pages/customerupdate.php...
CVE-2025-4503: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. This issue affects some unknown processing of the file /pages/customerupdate.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has bee...
Phishing Attack Uses Blob URIs to Show Fake Login Pages in Your Browser
Cofense Intelligence reveals a novel phishing technique using blob URIs to create local fake login pages, bypassing email…...
DEBIAN-CVE-2025-37868
In the Linux kernel, the following vulnerability has been resolved: drm/xe/userptr: fix notifier vs folio deadlock User is reporting what smells like notifier vs folio deadlock, where migratepagesbatch on core kernel side is holding folio locks and then interacting with the mappings of it, howeve...
UBUNTU-CVE-2025-37868
In the Linux kernel, the following vulnerability has been resolved: drm/xe/userptr: fix notifier vs folio deadlock User is reporting what smells like notifier vs folio deadlock, where migratepagesbatch on core kernel side is holding folio locks and then interacting with the mappings of it, howeve...
CVE-2025-37859 page_pool: avoid infinite loop to schedule delayed worker
In the Linux kernel, the following vulnerability has been resolved: pagepool: avoid infinite loop to schedule delayed worker We noticed the kworker in pagepoolreleaseretry was waken up repeatedly and infinitely in production because of the buggy driver causing the inflight less than 0 and warning...
XNU VM_BEHAVIOR_ZERO_WIRED_PAGES Page Write
There is an issue where XNU VMBEHAVIORZEROWIREDPAGES behavior allows writing to read-only pages...
38,000+ FreeDrain Subdomains Found Exploiting SEO to Steal Crypto Wallet Seed Phrases
Cybersecurity researchers have exposed what they say is an "industrial-scale, global cryptocurrency phishing operation" engineered to steal digital assets from cryptocurrency wallets for several years. The campaign has been codenamed FreeDrain by threat intelligence firms SentinelOne and Validin...