CVE-2025-40173

CVE-2025-40173 affects the Linux kernel’s net/ip6_tunnel code. The issue is described as an IPv6 tunnel headroom growth similar to the IPv4 case, where headroom was previously unbounded and now the IPv6 version is updated to reflect the IPv4 headroom ceiling. The consequence is described as a vul...

CVE-2025-40158 ipv6: use RCU in ip6_output()

In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6output Use RCU in ip6output in order to use dstdevrcu to prevent possible UAF. We can remove rcureadlock/rcureadunlock pairs from ip6finishoutput2...

CVE-2025-40158

In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6output Use RCU in ip6output in order to use dstdevrcu to prevent possible UAF. We can remove rcureadlock/rcureadunlock pairs from ip6finishoutput2...

CVE-2025-40135 ipv6: use RCU in ip6_xmit()

In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6xmit Use RCU in ip6xmit in order to use dstdevrcu to prevent possible UAF...

CVE-2025-40135

In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6xmit Use RCU in ip6xmit in order to use dstdevrcu to prevent possible UAF...

CVE-2025-12018

The MembershipWorks – Membership, Events & Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-12018

MembershipWorks – Membership, Events & Directory (WordPress) versions up to and including 6.14 are affected by a stored cross-site scripting vulnerability in admin settings due to inadequate input sanitization and output escaping. Exploitation requires an authenticated attacker with administrator...

CVE-2025-12018 MembershipWorks <= 6.14 - Authenticated (Admin+) Stored Cross-Site Scripting

The MembershipWorks – Membership, Events & Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress MembershipWorks plugin <= 6.14 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by ZAST.AI - ZAST.AI in WordPress Plugin MembershipWorks versions = 6.14...

Important: Red Hat Security Advisory: sssd security update

An update for sssd is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

CVE-2025-54983 Health check port on ZCC allows tunnel bypass

A health check port on Zscaler Client Connector on Windows, versions 4.6 4.6.0.216 and 4.7 4.7.0.47, which under specific circumstances was not released after use, allowed traffic to potentially bypass ZCC forwarding controls...

SUSE CVE-2025-64512

Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Prior to version 20251107, pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The CMapDB.loaddata function in...

CVE-2025-63289

Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encryptionhelper.dart file...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from ip6output not using RCU to protect dstdevrcu access, which could lead to reuse after release...

lightdm-kde-greeter -- Privilege Escalation from lightdm Service User to root

SUSE Security Team reports: A Execution with Unnecessary Privileges vulnerability in lightdm-kde-greeter allows escalation from the service user to root. This issue affects lightdm-kde-greeter before 6.0.4...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990870)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990870 advisory. In the Linux kernel, the following vulnerability has been resolved: ecryptfs: Fix buffer size for tag 66 packet The 'TAG 66 Packet Format' description is missing the...

PT-2025-46669

Name of the Vulnerable Software and Affected Versions Sogexia Android App versions SDK 35 through SDK 32 Description The Sogexia Android App contains hardcoded encryption keys within the encryption helper.dart file. These keys compromise the confidentiality of data encrypted by the application...

PT-2025-46710

Name of the Vulnerable Software and Affected Versions Dell SmartFabric OS10 Software versions prior to 10.6.1.0 Description Dell SmartFabric OS10 Software versions prior to 10.6.1.0 contain an Improper Neutralization of Special Elements used in a Command 'Command Injection' issue. A low privilege...

CVE-2025-63289

The Sogexia Android App , a payment account management mobile application, contains hardcoded encryption keys within the encryption_helper.dart file. This security flaw compromises the confidentiality of any data encrypted by the application. The vulnerability affects versions from SDK 32 through...

Zscaler Client Connector 安全漏洞

Zscaler Client Connector is a lightweight agent from Zscaler, Inc. A security vulnerability exists in the Zscaler Client Connector Windows version 4.6 up to and including version 4.6.0.216 and version 4.7 up to and including version 4.7.0.47, which stems from an unleashed health check port and...