CVE-2025-38512 affecting package kernel for versions less than 6.6.104.2-1

CVE-2025-38512 affecting package kernel for versions less than 6.6.104.2-1. An upgraded version of the package is available that resolves this issue...

AZL-68004 CVE-2025-39895 affecting package kernel for versions less than 6.6.112.1-1

In the Linux kernel, the following vulnerability has been resolved: sched: Fix schednumafindnthcpu if mask offline schednumafindnthcpu uses a bsearch to look for the 'closest' CPU in scheddomainsnumamasks and given cpus mask. However they might not intersect if all CPUs in the cpus mask are...

PT-2025-40286

Name of the Vulnerable Software and Affected Versions HP Support Assistant versions prior to 9.47.41.0 Description A security issue exists in HP Support Assistant that may allow a local attacker to gain higher-level access through arbitrary file writing. Recommendations Update HP Support Assistan...

Linux kernel 安全漏洞

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. A security vulnerability exists in the Linux kernel that originates from accessing an invalid offset field when resolving a back-reference to an inline extension followed by a pre-allocated extension,...

CVE-2025-59682

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common...

CVE-2025-56132

LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The application returns distinguishable responses for valid and invalid email addresses, allowing unauthenticated attackers to determine the existence of user accounts. Version 4.2...

CVE-2025-11153

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 143.0.3...

CVE-2025-41093

Insecure Direct Object Reference IDOR vulnerability in BOLD Workplanner in versions prior to 2.5.25 4935b438f9b, consisting of a lack of adequate validation of user input, allowing an authenticated user to access to basic contract details using unauthorised internal identifiers...

CVE-2025-41095

CVE-2025-41095 affects Bold Workplanner. Affected: versions prior to 2.5.25 (4935b438f9b). Issue: insecure direct object reference (IDOR) due to insufficient validation of user input, enabling an authenticated user to access planning counter details via unauthorized internal identifiers. Impact d...

CISA Sounds Alarm on Critical Sudo Flaw Actively Exploited in Linux and Unix Systems

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added a critical security flaw impacting the Sudo command-line utility for Linux and Unix-like operating systems to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation in the wild. The...

NewStart CGSL MAIN 6.06 : e2fsprogs Multiple Vulnerabilities (NS-SA-2025-0221)

The remote NewStart CGSL host, running version MAIN 6.06, has e2fsprogs packages installed that are affected by multiple vulnerabilities: - Heap-based buffer overflow in closefs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code by causing a crafte...

Foxit PDF Reader for Mac < 2025.2.1 Multiple Vulnerabilities

According to its version, the Foxit PDF Reader for Mac application previously named Foxit Reader for Mac installed on the remote macOS host is prior to 2025.2.1. It is, therefore affected by multiple vulnerabilities: - Addressed potential issues where the application could deliver incorrect...

Foxit PDF Editor for Mac < 13.2.1 / 14.0.1 / 2025.2.1 Multiple Vulnerabilities

According to its version, the Foxit PDF Editor for Mac application previously named Foxit PhantomPDF for Mac installed on the remote macOS host is prior to 2025.2.1/14.0.1/13.2.1. It is, therefore affected by multiple vulnerabilities: - Addressed potential issues where the application could deliv...

CVE-2025-59948

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not sanitize certain event handler attributes in feed content, so by finding a page that renders feed entries without CSP, it is possible to execute an XSS payload. The Allow API access authentication setting needs to ...

CVE-2025-34235 Vasion Print (formerly PrinterLogic) Weak SSL/TLS Certificate Validation RCE

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 Windows client deployments contain a registry key that can be enabled by administrators, causing the client to skip SSL/TLS certificate validation. An attacker who can...

Western Digital My Cloud 安全漏洞

Western Digital My Cloud is a personal cloud storage device from Western Digital. A security vulnerability exists in Western Digital My Cloud versions prior to 5.31.108, which stems from the user interface not handling input correctly and could lead to remote command execution...

Finding Phones Fast: Low-Latency and Scalable Monitoring of Cellular Communications in Sensitive Areas

The widespread availability of cellular devices introduces new threat vectors that allow users or attackers to bypass security policies and physical barriers and bring unauthorized devices into sensitive areas. These threats can arise from user non-compliance or deliberate actions aimed at data...

Exploit for CVE-2022-33679

CVE-2022-33679 Checker Lightweight checker that tests whether...

CVE-2025-9267

In Seagate Toolkit on Windows a vulnerability exists in the Toolkit Installer prior to versions 2.35.0.6 where it attempts to load DLLs from the current working directory without validating their origin or integrity. This behavior can be exploited by placing a malicious DLL in the same directory ...

WeGIA SQL注入漏洞

WeGIA is a web manager for welfare organizations by the individual developer Nilson Lazarin. An SQL injection vulnerability exists in WeGIA versions prior to 3.5.0 that stems from improper handling of the idproduto parameter in the control.php endpoint, which could lead to an SQL injection attack...