CVE-2025-68233

CVE-2025-68233 affects the Linux kernel's drm/tegra path. The fix adds a put_pid() call corresponding to get_task_pid() because host1x_memory_context_alloc() does not take ownership of the PID, preventing a PID leak. The commercial advisories (Ubuntu/SUSE/OpenSUSE/NASL plug-ins) list this CVE amo...

CVE-2025-68233 drm/tegra: Add call to put_pid()

In the Linux kernel, the following vulnerability has been resolved: drm/tegra: Add call to putpid Add a call to putpid corresponding to gettaskpid. host1xmemorycontextalloc does not take ownership of the PID so we need to free it here to avoid leaking. [email protected]: reword commit message...

PT-2025-51653

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue within the nilfs2 filesystem related to the handling of timers during segment constructor destruction. Specifically, the sc timer might remain active...

PT-2025-51663

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue related to the blocker tracking mechanism, which assumes 4-byte alignment of lock pointers. Some architectures, like m68k, only guarantee 2-byte...

PT-2025-51584

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue related to the handling of the XFD state during signal delivery. Specifically, when a non-AMX task is preempted by an AMX-enabled task that modifies th...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an unpurified configuration option in comedi:multiq3, which could lead to a task timeout...

PT-2025-51745

Name of the Vulnerable Software and Affected Versions Rukovoditel version 3.4.1 Description Rukovoditel version 3.4.1 has multiple stored cross-site scripting issues. Authenticated attackers can inject malicious scripts into project task comments. This allows them to execute arbitrary JavaScript ...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an unaligned lock pointer in hungtask causing a warning that could affect the m68k architecture...

Linux Distros Unpatched Vulnerability : CVE-2025-40358

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - riscv: stacktrace: Disable KASAN checks for non-current tasks Unwinding the stack of a task other than current, KASAN would report BUG: KASAN: out-of-bounds in...

Oracle Linux 9 : kernel (ELSA-2025-17377)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-17377 advisory. - wifi: ath12k: Decrement TID on RX peer frag setup error handling CKI Backport Bot RHEL-114705 CVE-2025-39761 - security/keys: fix slab-out-of-bounds...

CVE-2025-12348

The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.9.10. This is due to the plugin not properly verifying that a user is authorized to perform an action in the...

Incorrect Access Control

open-webui is vulnerable to Incorrect Access Control. The vulnerability is due to missing ownership verification in the /api/tasks/stop/ API, allowing a normal user to stop arbitrary LLM response tasks by directly cancelling tasks without proper authorization checks...

Cross-site Request Forgery

Jenkins Nexus Task Runner Plugin is vulnerable to a Cross-Site Request Forgery CSRF. The vulnerability is due to missing CSRF protection on sensitive plugin endpoints, where crafted requests can trigger actions without user interaction, allowing attackers to force an authenticated Jenkins user to...

Authorization Bypass

Jenkins Nexus Task Runner Plugin is vulnerable to an Authorization Bypass. The vulnerability is due to a missing permission check, allowing attackers with only Overall/Read permission to force the plugin to connect to an attacker-controlled URL using attacker-supplied credentials, potentially...

CVE-2025-14064

The BuddyTask plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on multiple AJAX endpoints in all versions up to, and including, 1.3.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

EUVD-2025-203012

The BuddyTask plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on multiple AJAX endpoints in all versions up to, and including, 1.3.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2025-14064

CVE-2025-14064 concerns BuddyTask for WordPress. The vulnerability arises from a missing capability check on multiple AJAX endpoints, affecting all versions up to and including 1.3.0. This allows authenticated attackers with Subscriber-level access or higher to view, create, modify, and delete ta...

CVE-2025-14064 BuddyTask <= 1.3.0 - Missing Authorization to Authenticated (Subscriber+) Cross-Group Task Board Access and Manipulation

The BuddyTask plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on multiple AJAX endpoints in all versions up to, and including, 1.3.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2025-14064 BuddyTask <= 1.3.0 - Missing Authorization to Authenticated (Subscriber+) Cross-Group Task Board Access and Manipulation

The BuddyTask plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on multiple AJAX endpoints in all versions up to, and including, 1.3.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2025-65854

CVE-2025-65854 : MineAdmin v3.x has insecure permissions in the scheduled tasks feature, allowing attackers to run arbitrary commands and potentially take full account control. The vulnerability stems from misconfigured permissions in the scheduled tasks component, with impact described as arbitr...