Use of Uninitialized Variable

Overview Affected versions of this package are vulnerable to Use of Uninitialized Variable due to the absent check of pimage value before calling opjj2kreadheader function. An attacker can achieve arbitrary code execution or cause a denial of service by supplying a specially crafted image file...

io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout

A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError...

Vulnerability fixed in SonicWall SonicOS

SonicWall has fixed a vulnerability in SonicOS. The vulnerability is in how SonicOS' SSL VPN interface handles externally controlled formatting strings. This can be exploited by external, unauthenticated attackers, leading to service disruptions. Attackers can exploit this vulnerability to affect...

WordPress oik plugin <= 4.15.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin oik versions = 4.15.2...

Vulnerabilities fixed in Apple macOS, iOS and iPadOS

Apple has fixed vulnerabilities in macOS, iOS and iPadOS. The vulnerabilities include several issues, such as insufficient input validation, memory corruption, and logic issues that can lead to unauthorized access to sensitive user data. These vulnerabilities can be exploited by malicious parties...

The vulnerability of the devm_kstrdup() function in the ASoC kernel of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the devmkstrdup function in the ASoC kernel of the Linux operating system is related to the lack of memory release after the effective lifespan of the function has ended. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the raid10_make_request() function in the raid10 component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the raid10makerequest function in the raid10 component of the Linux operating system is related to the lack of memory release after the effective lifespan of the function. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the `put_unused_fd()` function in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the putunusedfd function in the Linux operating system’s kernel is related to the lack of memory release after the effective lifespan of the function has ended. Exploiting this vulnerability could allow an attacker to trigger a service failure...

Xorux LPAR2RRD Read Only User Log Download Exposing Sensitive Information

Vulnerability Details Affected Vendor: Xorux Affected Product: LPAR2RRD Affected Version: 8.04 and prior Platform: Rocky Linux 8.10 CWE Classification: CWE-648: Incorrect Use of Privileged APIs CVE ID: CVE-2025-54768 2. Vulnerability Description An API endpoint that should be limited to web...

The vulnerability of the espintcp component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the espintcp component in the Linux operating system’s kernel is related to the lack of memory release after the effective lifespan of the component has ended. Exploiting this vulnerability can allow an attacker to cause a service failure...

Emby Windows Server Request Forgery Vulnerability

Emby Windows is a media playback application for the Windows platform developed by Emby LLC that supports Windows 10, 11 and later systems. Emby Windows suffers from a server-side request forgery vulnerability that stems from the server not implementing an adequate authentication mechanism to...

Vulnerabilities fixed in Firefox and Thunderbird

Mozilla has fixed vulnerabilities in Firefox and Thunderbird Specifically for versions under 141. The vulnerabilities cover a wide range of issues including execution of unauthorized code. These vulnerabilities can be exploited by malicious parties to gain access to sensitive information or...

Vulnerability fixed in Juniper Networks Security Director

Juniper has fixed a vulnerability in Juniper Networks Security Director. The vulnerability is located in the web interface of Juniper Networks Security Director, where insufficient authorization validation allows unauthenticated attackers to access and manipulate sensitive resources. This can lea...

Security Updates for Microsoft Office Products (July 2025)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2025-49695, CVE-2025-49696,...

Vulnerabilities fixed in Adobe Illustrator

Adobe has fixed vulnerabilities in Adobe Illustrator Versions 28.7.6, 29.5.1 and earlier. The vulnerabilities are in the way Adobe Illustrator handles rogue files. These vulnerabilities can lead to arbitrary code execution, allowing attackers to perform unauthorized actions on affected systems. T...

Stack-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Stack-based Buffer Overflow due to improper validation during parsing of H266 sei messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffe...

CVE-2025-53185

Virtual address reuse issue in the memory management module, which can be exploited by non-privileged users to access released memory Impact: Successful exploitation of this vulnerability may affect service integrity...

webkitgtk: Memory corruptions leading to arbitrary code execution

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. Processing maliciously crafted web content may lead to arbitrary code execution...

WordPress Element Pack Addons for Elementor plugin <= 8.0.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption Attribute vulnerability

Authenticated Contributor+ DOM-Based Stored Cross-Site Scripting via data-caption Attribute vulnerability discovered by Webbernaut in WordPress Plugin Element Pack Elementor Addons versions 8.0.0...

CVE-2025-6874

CVE-2025-6874 affects SourceCodester Best Salon Management System v1.0. The vulnerability resides in the file /panel/add_subscribe.php , where manipulating the parameters user_id/plan_id leads to a SQL injection. It can be exploited remotely and the exploit has been disclosed publicly. If exploit...