mongodb -- MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation

[email protected] reports: MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork state management...

nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()

...

Potential iSCSI R2T PDU Vulnerability

...

firmware: cs_dsp: Fix OOB memory read access in KUnit test (wmfw info)

...

drm/amd/display: Wrap dcn301_calculate_wm_and_dlg for FPU.

...

iommu: Clear iommu-dma ops on cleanup

...

drm/amd/display: Wake DMCUB before executing GPINT commands

...

iommu/vt-d: Use device rbtree in iopf reporting path

...

drm/amdgpu/pm: fix the null pointer while the smu is disabled

...

CVE-2025-9791

A weakness has been identified in Tenda AC20 16.03.08.05. This vulnerability affects unknown code of the file /goform/fromAdvSetMacMtuWan. This manipulation of the argument wanMTU causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made availabl...

Nginx Unit Java Language Server DoS

The vulnerability of the Nginx Unit application’s Java Language Server module relates to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

CVE-2025-9717 O2OA Personal Profile unit cross site scripting

A vulnerability was identified in O2OA up to 10.0-410. Affected by this issue is some unknown functionality of the file /xorganizationassemblecontrol/jaxrs/unit/ of the component Personal Profile Page. Such manipulation of the argument name/shortName/distinguishedName/pinyin/pinyinInitial/levelNa...

CVE-2025-9717

A vulnerability was identified in O2OA up to 10.0-410. Affected by this issue is some unknown functionality of the file /xorganizationassemblecontrol/jaxrs/unit/ of the component Personal Profile Page. Such manipulation of the argument name/shortName/distinguishedName/pinyin/pinyinInitial/levelNa...

CVE-2025-9717

CVE-2025-9717 affects O2OA up to version 10.0-410, specifically the Personal Profile Page component. The vulnerability stems from cross-site scripting in the file path /x_organization_assemble_control/jaxrs/unit/, where manipulation of arguments such as name, shortName, distinguishedName, pinyin,...

CVE-2025-9593

A flaw has been found in itsourcecode Apartment Management System 1.0. Impacted is an unknown function of the file /report/unitstatusinfo.php. Executing manipulation of the argument usid can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used...

CVE-2025-9717: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in O2OA up to 10.0-410. Affected by this issue is some unknown functionality of the file /xorganizationassemblecontrol/jaxrs/unit/ of the component Personal Profile Page. Such manipulation of the argument name/shortName/distinguishedName/pinyin/pinyinInitial/levelNa...

O2OA security vulnerabilities

O2OA is an enterprise application development platform from O2OA open source. A security vulnerability exists in O2OA 10.0-410 and earlier versions, which originates from a cross-site scripting error in the parameter name/shortName/distinguishedName/pinyin/ in the file...

Apartment Management System unit_status_info.php File SQL Injection Vulnerability

Apartment Management System is an apartment management system. Apartment Management System suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the parameter usid in the file /report/unitstatusinfo.php. An attacker can exploit...

CVE-2025-25735

Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units RSUs v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack SPI Protected Range Registers PRRs, allowing attackers with software running on the system to modify SPI flash in real-time...

CVE-2025-50974

The Calamaris log exporter CGI /cgi-bin/logs.cgi/calamaris.dat in IPFire 2.29 does not properly sanitize user-supplied input before incorporating parameter values into a shell command. An unauthenticated remote attacker can inject arbitrary OS commands by embedding shell metacharacters in any of...