Astra Linux – Vulnerability in Intel Microcode

mirrored regions with different values in 3rd generation IntelR XeonR Scalable processors may allow a privileged user to potentially enable denial of service via local access...

Astra Linux – Vulnerability in Intel Microcode

Improper initialization in UEFI firmware. The OutOfBandXML module in some Intel processors may allow a privileged user to potentially enable information disclosure through local access...

Astra Linux – Vulnerability in Intel Microcode

Improper input validation in UEFI firmware for some Intel processors may allow a privileged user to potentially enable privilege escalation through local access...

Astra Linux – Vulnerability in Intel Microcode

Improper finite state machines FSMs in hardware logic of certain Intel processors may allow a privileged user to potentially exploit a denial of service attack through local access...

CVE-2025-0917

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...

IBM Security Guardium Information Disclosure Vulnerability (CNVD-2025-12296)

IBM Security Guardium is a suite of platforms from International Business Machines IBM that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. IBM Security Guardium has an information disclosure...

CVE-2025-42993

Due to a missing authorization check vulnerability in SAP S/4HANA Enterprise Event Enablement, an attacker with access to the Inbound Binding Configuration could create an RFC destination and assign an arbitrary high-privilege user. This allows the attacker to consume events via the RFC...

CVE-2025-42977

SAP NetWeaver Visual Composer contains a Directory Traversal vulnerability caused by insufficient validation of input paths provided by a high-privileged user. This allows an attacker to read or modify arbitrary files, resulting in a high impact on confidentiality and a low impact on integrity...

CVE-2025-42977 Directory Traversal vulnerability in SAP NetWeaver Visual Composer

SAP NetWeaver Visual Composer contains a Directory Traversal vulnerability caused by insufficient validation of input paths provided by a high-privileged user. This allows an attacker to read or modify arbitrary files, resulting in a high impact on confidentiality and a low impact on integrity...

CVE-2025-42977 Directory Traversal vulnerability in SAP NetWeaver Visual Composer

SAP NetWeaver Visual Composer contains a Directory Traversal vulnerability caused by insufficient validation of input paths provided by a high-privileged user. This allows an attacker to read or modify arbitrary files, resulting in a high impact on confidentiality and a low impact on integrity...

CVE-2025-49138

HAX CMS PHP before v11.0.0 is vulnerable to an authenticated Local File Inclusion via the saveOutline API. The backend stores the provided location value directly into site.json without validation, allowing an attacker to craft a relative path (for example ../../../etc/passwd) to read arbitrary f...

CVE-2025-1246

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operation...

CVE-2024-45655 IBM Application Gateway incorrect permission assignment

IBM Application Gateway 19.12 through 24.09 could allow a local privileged user to perform unauthorized actions due to incorrect permissions assignment...

CVE-2025-20297

In Splunk Enterprise versions below 9.4.2, 9.3.4 and 9.2.6, and Splunk Cloud Platform versions below 9.3.2411.102, 9.3.2408.111 and 9.2.2406.118, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the pdfgen/render REST endpoint th...

CVE-2025-20297

In Splunk Enterprise versions below 9.4.2, 9.3.4 and 9.2.6, and Splunk Cloud Platform versions below 9.3.2411.102, 9.3.2408.111 and 9.2.2406.118, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the pdfgen/render REST endpoint th...

CVE-2025-20297

Vulnerability CVE-2025-20297 affects Splunk Enterprise before 9.4.2, 9.3.4, and 9.2.6, and Splunk Cloud Platform before 9.3.2411.102, 9.3.2408.111, and 9.2.2406.118. A low-privileged user can craft a payload via the pdfgen/render REST endpoint, potentially executing unauthorized JavaScript in a u...

CVE-2025-0819

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to gain access to already freed memory.This issue...

CVE-2025-1246

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operation...

CVE-2025-1246 Mali GPU Userspace Driver allows an Out-of-Bounds access

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operation...

CVE-2025-0819

CVE-2025-0819 is a Use After Free vulnerability in ARM GPU kernel drivers. A local, non-privileged user can access already freed memory via GPU memory processing. Affected components and versions (from connected docs): Arm Bifrost GPU Kernel Driver r44p0–r51p0; Arm Valhall GPU Kernel Driver r44p0...