windows-privesc-check

It is an offensive tool for Windows privilege escalation checking. The tool, windows-privesc-check, is a standalone executable that runs on Windows systems, attempting to find misconfigurations that could allow local unprivileged users to escalate privileges to other users or access local apps. I...

CVE-2025-10331 cdevroe unmark Marks.php cross site scripting

A vulnerability has been found in cdevroe unmark up to 1.9.3. This issue affects some unknown processing of the file /application/controllers/Marks.php. Such manipulation of the argument Title leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to th...

OSV-2025-723 Heap-buffer-overflow in processClientServerHello

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=444547710 Crash type: Heap-buffer-overflow READ 2 Crash state: processClientServerHello processtls fuzzquicgetcryptodata.c...

CLSA-2025-1757693980 kernel: Fix of 40 CVEs

x86/kvm: Disable kvmclock on all CPUs on shutdown CVE-2021-47110 - posix-cpu-timers: fix race between handleposixcputimers and posixcputimerdel CVE-2025-38352 - cifs: fix double free race when mount fails in cifsgetroot CVE-2022-48919 - aio: mark AIO pseudo-fs noexec CVE-2016-10044 - cifs:...

WordPress Logtik theme <= 2.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Logtik versions = 2.3...

Muck Stealer Malware Used Alongside Phishing in New Attack Waves

A new report from Cofense reveals that cybercriminals are blending phishing and malware, including Muck Stealer, Info Stealer,…...

BELL-CVE-2025-39746

Bulletin has no description...

Windows kernel Unauthorized Access

The vulnerability of Windows operating system kernels is related to deficiencies in the mechanism for generating error reports. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

DEBIAN-CVE-2025-39765

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: fix idafree call while not allocated In the sndutimercreate function, if the kasprintf function return NULL, sndutimerputid will be called, finally use idafree to free the unallocated id 0. the syzkaller reported the...

UBUNTU-CVE-2025-39748

In the Linux kernel, the following vulnerability has been resolved: bpf: Forget ranges when refining tnum after JSET Syzbot reported a kernel warning due to a range invariant violation on the following BPF program. 0: call bpfgetnetnscookie 1: if r0 == 0 goto 2: if r0 & Oxffffffff goto The issue ...

Security update for kernel-livepatch-MICRO-6-0-RT_Update_10

This update for kernel-livepatch-MICRO-6-0-RTUpdate10 fixes the following issues: CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU bsc1246030 CVE-2025-38494: HID: core: do not bypass hidhwrawrequest bsc1247350 CVE-2025-38495: HID: core: ensure the allocated report buffer can contain the...

SUSE-SU-2025:20713-1 Security update for kernel-livepatch-MICRO-6-0-RT_Update_10

This update for kernel-livepatch-MICRO-6-0-RTUpdate10 fixes the following issues: - CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU bsc1246030 - CVE-2025-38494: HID: core: do not bypass hidhwrawrequest bsc1247350 - CVE-2025-38495: HID: core: ensure the allocated report buffer can conta...

SUSE-SU-2025:20781-1 Security update for kernel-livepatch-MICRO-6-0-RT_Update_10

This update for kernel-livepatch-MICRO-6-0-RTUpdate10 fixes the following issues: - CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU bsc1246030 - CVE-2025-38494: HID: core: do not bypass hidhwrawrequest bsc1247350 - CVE-2025-38495: HID: core: ensure the allocated report buffer can conta...

CVE-2025-40694

Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'fromdate' and 'todate' parameters via POST at the endpoint '/ofrs/admin/bwdates-report-result.php'. This vulnerability...

CVE-2025-40691

SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'todate' parameter in the endpoint '/ofrs/admin/bwdates-report-result.php'...

CVE-2025-40691

SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'todate' parameter in the endpoint '/ofrs/admin/bwdates-report-result.php'...

PT-2025-37117

Name of the Vulnerable Software and Affected Versions PuneethReddyHC Event Management System version 1.0 Description A reflected Cross-Site Scripting XSS issue exists in the register.php script. The mobile parameter is not properly validated, and its value is echoed in the HTTP response without...

PT-2025-37175

Name of the Vulnerable Software and Affected Versions: Online Fire Reporting System version 1.2 Description: The Online Fire Reporting System contains a SQL injection flaw. This flaw allows an attacker to retrieve, create, update, and delete database information via the todate parameter in the...

Online Fire Reporting System SQL Injection Vulnerability

Online Fire Reporting System is an online fire reporting system developed by Carlo Montero, an individual developer. A SQL injection vulnerability exists in Online Fire Reporting System version 1.2, which stems from an incorrect manipulation of the parameter todate in the file...

MAL-2025-46998 Malicious code in tdm-shared-core-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f40d5eac324a286d10c565745ab72ab39f4b9ffa1fc95fc0bbf40101f44a6955 The OpenSSF Package Analysis project identified 'tdm-shared-core-library' @ 99.0.3 npm as malicious. It is considered malicious because: - The...