CVE-2024-45557 Use of Out-of-range Pointer Offset in Trust Management Engine

Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation...

CVE-2024-45557

CVE-2024-45557 describes memory corruption in Qualcomm’s Trust Management Engine (TME) when it processes addresses from TZ and MPSS requests without proper validation, affecting Qualcomm chipsets. The CVSSv3.1 base score is 7.8 (High) with Local, Low complexity, Low privileges, and no user intera...

CVE-2025-32118

Unrestricted Upload of File with Dangerous Type vulnerability in NiteoThemes CMP – Coming Soon & Maintenance cmp-coming-soon-maintenance allows Using Malicious Files.This issue affects CMP – Coming Soon & Maintenance: from n/a through = 4.1.14...

CVE-2025-32203

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in manu225 Falling things falling-things allows SQL Injection.This issue affects Falling things: from n/a through = 1.08...

CVE-2025-32165

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in fromdoppler Doppler Forms doppler-form allows Stored XSS.This issue affects Doppler Forms: from n/a through = 2.5.1...

CVE-2025-32127

CVE-2025-32127 concerns an SQL Injection in onOffice for WP-Websites (WordPress plugin) where improper neutralization of special elements in SQL commands is reported. Affected version range is onOffice for WP-Websites: from n/a through 5.7. The provided material cites a base score of 7.6 (HIGH) w...

CVE-2025-3087

Stored XSS in M-Files Web versions from 25.1.14445.5 to 25.2.14524.4 allows an authenticated user to run scripts...

SUSE CVE-2025-21939

In the Linux kernel, the following vulnerability has been resolved: drm/xe/hmm: Don't dereference struct page pointers without notifier lock The pnfs that we obtain from hmmrangefault point to pages that we don't have a reference on, and the guarantee that they are still in the cpu page-tables is...

WordPress plugin Booster for WooCommerce 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

CVE-2025-31127 Element X Android allows the entity in control of the well-known file to break the confidentiality embedded Element Call

Element X Android is a Matrix Android Client provided by element.io. In Element X Android versions between 0.4.16 and 25.03.3, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. Thi...

CVE-2025-31815

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in devscred Design Blocks exclusive-blocks allows Stored XSS.This issue affects Design Blocks: from n/a through = 1.2.5...

DEBIAN-CVE-2025-3158

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of the file code/AssetLib/LWO/LWOAnimation.cpp of the component LWO File Handler. The manipulation...

Element X iOS 信息泄露漏洞

Element X iOS is an Element open source next-generation Matrix client for iOS built on SwiftUI for Matrix rust-sdk. An information disclosure vulnerability exists in Element X iOS versions 1.6.13 through 25.03.7, which originates in the element.json file and could lead to the disclosure of media...

Open Solutions For Education openSIS 安全漏洞

Open Solutions For Education openSIS is an open source student information management system from Open Solutions For Education, USA. A security vulnerability exists in Open Solutions For Education openSIS versions v8.0 through v9.1 that stems from a directory traversal issue...

CVE-2025-31697

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Formatter Suite allows Cross-Site Scripting XSS.This issue affects Formatter Suite: from 0.0.0 before 2.1.0...

CVE-2025-31549

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Agency Dominion Inc. Fusion fusion allows DOM-Based XSS.This issue affects Fusion: from n/a through = 1.6.4...

CVE-2025-31614

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hiroprot Terms Before Download terms-before-download allows Stored XSS.This issue affects Terms Before Download: from n/a through = 1.0.5...

SUSE CVE-2025-21913

In the Linux kernel, the following vulnerability has been resolved: x86/amdnb: Use rdmsrsafe in amdgetmmconfigrange Xen doesn't offer MSRFAM10HMMIOCONFBASE to all guests. This results in the following warning: unchecked MSR access error: RDMSR from 0xc0010058 at rIP: 0xffffffff8101d19f...

SUSE CVE-2025-21933

In the Linux kernel, the following vulnerability has been resolved: arm: pgtable: fix NULL pointer dereference issue When updatemmucacherange is called by updatemmucache, the vmf parameter is NULL, which will cause a NULL pointer dereference issue in adjustpte: Unable to handle kernel NULL pointe...

Pexip Infinity 输入验证错误漏洞

Pexip Infinity Pexip Video Conferencing Cloud Collaboration Platform is a video conferencing cloud collaboration platform from Pexip, Norway. The product provides high quality and secure cloud conferencing capabilities. A security vulnerability exists in Pexip Infinity versions 29 through 36.2 th...