Cross-site Request Forgery (CSRF)

Overview org.jenkins-ci.plugins:windocks-start-container is an Allows users to create running containers based on Images available on the WinDocks host. WinDocks is a port of Docker’s open source to Windows, and supports all editions of Windows 8, Windows 10, Windows Server 2012, and Windows Serv...

PT-2025-44288

Name of the Vulnerable Software and Affected Versions Jenkins Start Windocks Containers Plugin versions 1.4 and earlier Description A missing permission check allows attackers with Overall/Read permission to connect to a URL specified by the attacker. Recommendations Update Jenkins Start Windocks...

CVE-2025-62931

Missing Authorization vulnerability in microsoftstart MSN Partner Hub microsoft-start allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MSN Partner Hub: from n/a through = 2.9...

kernel: pstore/ram: Check start of empty przs during init

An out of bounds array vulnerability exists in the linux kernel, such that a missing check on the start field of a PRZ persistent ram zone during initialization leads to damage to the availability and integrity of the system...

EUVD-2025-36010

Missing Authorization vulnerability in microsoftstart MSN Partner Hub microsoft-start allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MSN Partner Hub: from n/a through = 2.8.7...

CVE-2025-62931

Missing Authorization vulnerability in microsoftstart MSN Partner Hub microsoft-start allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MSN Partner Hub: from n/a through = 2.9...

PT-2025-43807

Missing Authorization vulnerability in microsoftstart MSN Partner Hub microsoft-start allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MSN Partner Hub: from n/a through = 2.8.7...

CVE-2025-12016

The qnotsquiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qnotsquizcustomstarttext' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2025-35831

In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption Move the ssize check to the start in essivaeadcrypt so that it's also checked for decryption and in-place encryption...

PT-2025-43598

Name of the Vulnerable Software and Affected Versions qnotsquiz plugin for WordPress versions prior to 1.0.1 Description The qnotsquiz plugin for WordPress is susceptible to Stored Cross-Site Scripting through the qnotsquiz custom start text parameter. Insufficient input sanitization and output...

EUVD-2023-60007

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix a NULL pointer dereference in ath12kmacophwscan In ath12kmacophwscan, the return value of kzalloc is directly used in memcpy, which may lead to a NULL pointer dereference on failure of kzalloc. Fix this bug by...

SUSE CVE-2025-40015

In the Linux kernel, the following vulnerability has been resolved: media: stm32-csi: Fix dereference before NULL check In 'stm32csistart', 'csidev-ssubdev' is dereferenced directly while assigning a value to the 'srcpad'. However the same value is being checked against NULL at a later point of...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987614)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987614 advisory. In the Linux kernel, the following vulnerability has been resolved: tracing: Fix sleeping function called from invalid context on RT kernel When setting...

CVE-2025-40015

In the Linux kernel, the following vulnerability has been resolved: media: stm32-csi: Fix dereference before NULL check In 'stm32csistart', 'csidev-ssubdev' is dereferenced directly while assigning a value to the 'srcpad'. However the same value is being checked against NULL at a later point of...

CVE-2025-40015

In CVE-2025-40015, the Linux kernel vulnerability is in the media: stm32-csi driver. The issue arises in stm32_csi_start where csidev->s_subdev is dereferenced while assigning to src_pad before a NULL check, creating a potential NULL dereference. The fix moves the dereference after the NULL ch...

CVE-2025-40015 media: stm32-csi: Fix dereference before NULL check

In the Linux kernel, the following vulnerability has been resolved: media: stm32-csi: Fix dereference before NULL check In 'stm32csistart', 'csidev-ssubdev' is dereferenced directly while assigning a value to the 'srcpad'. However the same value is being checked against NULL at a later point of...

[SECURITY] Fedora 42 Update: runc-1.3.2-1.fc42

The runc command can be used to start containers which are packaged in accordance with the Open Container Initiative's specifications, and to manage containers running under runc...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the start and end request parameters in CargoExport.php. An attacker can execute arbitrary SQL commands by submitting crafted input to the affected endpoint. Remediation Upgrade mediawiki/cargo to version 3.8.4 or...

JLSEC-2025-81 Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the...

Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service DoS via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support...

CVE-2025-62417

Bagisto is an open source laravel eCommerce platform. When product data that begins with a spreadsheet formula character for example =, +, -, or @ is accepted and later exported or saved into a CSV and opened in spreadsheet software, the spreadsheet will interpret that cell as a formula. This...