25043 matches found
CVE-2025-69207 Khoj has an IDOR in Notion OAuth Flow Enables Index Poisoning
Khoj is a self-hostable artificial intelligence app. Prior to 2.0.0-beta.23, an IDOR in the Notion OAuth callback allows an attacker to hijack any user's Notion integration by manipulating the state parameter. The callback endpoint accepts any user UUID without verifying the OAuth flow was...
MINI-27R3-526R-R5HQ
Bulletin has no description...
CVE-2025-47397
CVE-2025-47397 describes a memory corruption vulnerability in GPU memory mapping using scatter-gather lists caused by unchecked IOMMU mapping errors. Affected component is involved in GPU memory mapping; the issue is exploitable locally with low privileges and no user interaction, with high impac...
MAL-2026-652 Malicious code in chia-pool-reference (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 51f7e4eb8c8b82bd7c7514255d0eb51dddc657c4b06845232ad8490a514a139c Obfuscated code is used to hide exfiltration of basic data hostname, etc.. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but...
MINI-RV99-WPRJ-PV4H
Bulletin has no description...
MINI-85PH-HC68-MMXG
Bulletin has no description...
MINI-HFCH-3HRG-CFC9
Bulletin has no description...
CVE-2025-71189
In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw: dmamux: fix OF node leak on route allocation failure Make sure to drop the reference taken to the DMA master OF node also on late route allocation failures...
MINI-Q39W-MWMM-7XRG
Bulletin has no description...
MINI-7J9Q-CXWX-P658
Bulletin has no description...
MINI-833M-Q65X-R4QJ
Bulletin has no description...
WordPress SP Project & Document Manager plugin <= 4.71 - Subscriber+ File Download via IDOR vulnerability
Subscriber+ File Download via IDOR vulnerability discovered by fewwords in WordPress Plugin SP Project & Document Manager versions = 4.71...
kernel: mptcp: fix race condition in mptcp_schedule_work()
A race in mptcpschedulework could lead to a use-after-free: the function queued work and only then acquired a reference to the socket. If the worker ran to completion immediately, the subsequent sockhold operated on a freed object. Impact ranges from kernel crash DoS to potential privilege...
kernel security update
6.12.0-124.31.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...
MINI-Q52V-4CQ5-FV65
Bulletin has no description...
MINI-P2X4-57WW-C76F
Bulletin has no description...
CVE-2026-1251
The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.4 via the 'addreply' function due to missing validation on a user controlled key. This makes it possible for authenticated...
ECHO-B830-9BC8-D435
Bulletin has no description...