13077 matches found
CVE-2025-38200 i40e: fix MMIO write access to an invalid page in i40e_clear_hw
In the Linux kernel, the following vulnerability has been resolved: i40e: fix MMIO write access to an invalid page in i40eclearhw When the device sends a specific input, an integer underflow can occur, leading to MMIO write access to an invalid page. Prevent the integer underflow by changing the...
CGA-9J7V-5346-6PRQ
Bulletin has no description...
MAL-2025-6543 Malicious code in malimalooo (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 68fa420b0a99cf34a9226a9deb8781219fd54964c91f41a41d2867063a365c32 The only goal of the package is to execute a webhook or a suspicious file during installation. Closely related to 2025-07-0x9xnx - created after previous...
CGA-H7R3-FJ26-R2MJ
Bulletin has no description...
CGA-62CC-92JJ-X57C
Bulletin has no description...
CGA-F6P7-JP48-98XF
Bulletin has no description...
MAL-2025-5656 Malicious code in malinssx (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 ec1d3e0940a3c37917b528689547d3728f9f3d0b9e408acc7dcc67435c09d2b0 The only goal of the package is to execute a webhook or a suspicious file during installation. Closely related to 2025-07-0x9xnx - created after previous...
WordPress Posts Slider Shortcode plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by Peter Thaleikis in WordPress Plugin Posts Slider Shortcode versions = 1.0...
MAL-2025-6588 Malicious code in solana-sdkpy (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 fa656c982797b0a9ae09399aa3204b8925d4608935f9b563f498224bebf39b04 Series of packages mostly with an obfuscated infostealer attempting to collect Chrome data. While discord webhook is usually set to an example, there are other...
MAL-2025-6571 Malicious code in pypiion (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 45829fe35be9020b9109d3f502be2f392cde33801689e007f89d67a3a7c0415d Series of packages mostly with an obfuscated infostealer attempting to collect Chrome data. While discord webhook is usually set to an example, there are other...
CVE-2025-24748
Missing Authorization vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through = 7.11.10...
MAL-2025-5653 Malicious code in hellodista (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 988e08e45c0c2fdbdf337e012d3930d14eedbe4add858a55cee2156849033b90 Series of packages mostly with an obfuscated infostealer attempting to collect Chrome data. While discord webhook is usually set to an example, there are other...
BIT-MODSECURITY2-2025-52891 ModSecurity empty XML tag causes segmentation fault
ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least...
BIT-LIMESURVEY-2024-42901
A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file...
BELL-CVE-2025-38105
Bulletin has no description...
BELL-CVE-2025-38147
Bulletin has no description...
Cockpit - Content Platform vulnerable to XSS through name or email argument names
A vulnerability was found in Cockpit versions up to 2.11.3. This issue affects some unknown processing instances of the file /system/users/save. The manipulation of the arguments "name" or "email" leads to cross-site scripting. The attack may be initiated remotely. Upgrading to version 2.11.4 wil...
CVE-2025-49601
In MbedTLS 3.3.0 before 3.6.4, mbedtlslmsimportpublickey does not check that the input buffer is at least 4 bytes before reading a 32-bit field, allowing a possible out-of-bounds read on truncated input. Specifically, an out-of-bounds read in mbedtlslmsimportpublickey allows context-dependent...
Next.JS vulnerability can lead to DoS via cache poisoning
Summary A vulnerability affecting Next.js has been addressed. It impacted versions 15.0.4 through 15.1.8 and involved a cache poisoning bug leading to a Denial of Service DoS condition. Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to th...