Important: microcode_ctl

Issue Overview: Insufficient granularity of access control in the OOB-MSM for some IntelR XeonR 6 Scalable processors may allow a privileged user to potentially enable escalation of privilege via adjacent access. CVE-2025-22839 Sequence of processor instructions leads to unexpected behavior for...

Linux SMB Server Crypt Message Buffer Overflow Info Disclosure

The vulnerability of the ksmbdcryptmessage function in the fs/smb/server/auth.c module of the SMB server support in Linux operating systems is related to the absence of resetting of cryptographic data after its use. Exploiting this vulnerability can allow an attacker to gain access to protected...

CVE-2025-10880

All versions of Dingtian DT-R002 are vulnerable to an Insufficiently Protected Credentials vulnerability that could allow an attacker to extract the proprietary "Dingtian Binary" protocol password by sending an unauthenticated GET request...

CVE-2025-9984

CVE-2025-9984 (FIFU, Featured Image from URL, WordPress) : The FIFU plugin is vulnerable to an unauthorized access exposure due to a missing capability check in fifu_api_debug_posts(). This allows unauthenticated attackers to read private/password protected posts in all versions up to 5.2.7. Conn...

PT-2025-39498

Name of the Vulnerable Software and Affected Versions Featured Image from URL FIFU plugin for WordPress versions through 5.2.7 Description The plugin is susceptible to unauthorized data access because of a missing capability check within the fifu api debug posts function. This allows...

NVIDIA Guest Driver Virtual GPU Manager Disclosure

The vulnerability of the Guest driver components and the Virtual GPU Manager driver of NVIDIA graphics processors is related to reading beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to disclose protected information...

MEAC300-FNADE4 Information Disclosure

The vulnerability of the microprogrammed industrial digital gas analyzer MEAC300-FNADE4 relates to the disclosure of information through the reading of catalog files. Exploiting this vulnerability can allow an unauthorized person to gain unauthorized access to protected information...

CVE-2025-10879

All versions of Dingtian DT-R002 are vulnerable to an Insufficiently Protected Credentials vulnerability that could allow an attacker to retrieve the current user's username without authentication...

CVE-2025-59841

Flag Forge is a Capture The Flag CTF platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation. Authenticated users can continue to access protected endpoints, such as /api/profile, even after logging out. CSRF tokens are also still...

CVE-2025-59841 FlagForgeCTF's Improper Session Handling Allows Access After Logout

Flag Forge is a Capture The Flag CTF platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation. Authenticated users can continue to access protected endpoints, such as /api/profile, even after logging out. CSRF tokens are also still...

Improper Access Control

contao/contao is vulnerable to Improper Access Control. The vulnerability is due to protected content elements rendered as fragments being indexed in the front-end search, which allows an attacker to access sensitive content publicly...

Improper Access Control

contao/contao is vulnerable to Improper Access Control. The vulnerability is due to news feeds not filtering protected news archives, which allows an attacker to access and view restricted news items through the public RSS feed...

Android setRingtoneUri Ringtone Disclosure

The vulnerability of the setRingtoneUri function in the VoicemailNotificationSettingsUtil.java module of Android operating systems is related to the possibility of bypassing access control mechanisms. Exploiting this vulnerability could allow an attacker to disclose protected information...

CVE-2025-10880: Insufficiently Protected Credentials

All versions of Dingtian DT-R002 are vulnerable to an Insufficiently Protected Credentials vulnerability that could allow an attacker to extract the proprietary "Dingtian Binary" protocol password by sending an unauthenticated GET request...

CVE-2025-10879: Insufficiently Protected Credentials

All versions of Dingtian DT-R002 are vulnerable to an Insufficiently Protected Credentials vulnerability that could allow an attacker to retrieve the current user's username without authentication...

ROS-20250925-02

Vulnerability of TarFile.extractall and TarFile.extract functions of tarfile module of Python programming language interpreter CPython is related to incorrect restriction of path name of restricted directory. Python programming language interpreter CPython functions TarFile.extractall and...

PT-2025-39418

Name of the Vulnerable Software and Affected Versions Flag Forge versions 2.2.0 through 2.3.0 Description Flag Forge improperly manages session invalidation. After a user logs out, they can still access protected endpoints, such as /api/profile, and CSRF tokens remain valid. This allows continued...

Android isSystemUid Disclosure

The vulnerability of the isSystemUid function in the AccountManagerService.java module of Android operating systems is related to the possibility of bypassing access control mechanisms. Exploiting this vulnerability could allow attackers to disclose protected information...

Framework Android Disclosure

The vulnerability of the Framework component in Android operating systems is related to the absence of authentication procedures. Exploiting this vulnerability can allow attackers to disclose protected information...

FosWiki Unauthorized Access

The vulnerability of the FosWiki platform lies in the lack of measures taken to protect the website’s structure. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...