PT-2025-17365 · Apache · Apache Http Server

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server affected versions not specified Description: The issue concerns unvalidated user input. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issu...

PT-2025-17368 · Apache · Apache Http Server

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server affected versions not specified Description: The issue concerns unvalidated user input. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issu...

Stage File Proxy - Moderately critical - Denial of Service - SA-CONTRIB-2025-035

Stage File Proxy is a general solution for getting production files on a development server on demand. The module doesn't sufficiently validate the existence of remote files prior to attempting to download and create them. An attacker could send many requests and exhaust disk resources. This...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an unvalidated queue quantum parameter in the ice driver, which could lead to out-of-bounds access...

The vulnerability of the hda_sdw_machine_select() function in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the hdasdwmachineselect function in the Linux operating system is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2025-32778 Web-Check allows command Injection via Unvalidated URL in Screenshot API

Web-Check is an all-in-one OSINT tool for analyzing any website. A command injection vulnerability exists in the screenshot API of the Web Check project Lissy93/web-check. The issue stems from user-controlled input url being passed unsanitized into a shell command using exec, allowing attackers t...

CVE-2025-32778 Web-Check allows command Injection via Unvalidated URL in Screenshot API

Web-Check is an all-in-one OSINT tool for analyzing any website. A command injection vulnerability exists in the screenshot API of the Web Check project Lissy93/web-check. The issue stems from user-controlled input url being passed unsanitized into a shell command using exec, allowing attackers t...

CVE-2025-32778

CVE-2025-32778 affects Web-Check’s /api/screenshot endpoint. A user-controlled url is passed to a shell command via exec(), enabling command injection that could lead to arbitrary commands on the host. The issue is mitigated by replacing exec() with execFile(), which avoids a shell and properly i...

CVE-2025-3522

Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to determine file size, and navigates to it when the user clicks the attachment. Because the URL is not validate...

PT-2025-16301 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue concerns an unvalidated redirect in a meeting center application. No further details are available about the issue, including the number of potentially affected devices or real-wor...

PT-2025-16302 · Apache · Apache Http Server

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server affected versions not specified Description: The issue concerns unvalidated user input in the Apache HTTP Server. No specific details about the number of potentially affected devices or real-world incidents are provided...

PT-2025-16304 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A vulnerability has been identified, but details are not provided. The issue is related to an unvalidated request parameter in an unspecified product. Recommendations: At the moment, there i...

Vulnerability of the smu_v13_0_update_pcie_parameters() function in the drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c module – This driver supports AMD graphics card Direct Rendering Infrastructure (DRI) in Linux operating systems. It can be exploited by attackers to compromise the confidentiality, integrity, and accessibility of protected information.

Vulnerability of the smuv130updatepcieparameters function in the drivers/gpu/drm/amd/pm/swsmu/smu13/smuv130.c module – The driver that supports Direct Rendering Infrastructure DRI for AMD graphics cards in Linux operating systems has a unvalidated array indexing issue. Exploiting this vulnerabili...

Vulnerability of the ath11k_dp_process_rx() function in the drivers/net/wireless/ath/ath11k/dp_rx.c module – The driver for Atheros/Qualcomm wireless adapter support in the Linux operating system, which allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the ath11kdpprocessrx function in the drivers/net/wireless/ath/ath11k/dprx.c module of the Atheros/Qualcomm wireless adapter driver for the Linux operating system is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to compromise the...

Vulnerability of the function dcn35_clk_mgr_helper_populate_bw_params() in the module drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c – A driver for supporting Direct Rendering Infrastructure (DRI) in AMD graphics cards with Linux operating systems. This vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information.

Vulnerability of the function dcn35clkmgrhelperpopulatebwparams in the module drivers/gpu/drm/amd/display/dc/clkmgr/dcn35/dcn35clkmgr.c – Drivers supporting Direct Rendering Infrastructure DRI for AMD graphics cards with Linux operating systems have a unvalidated array indexing issue. Exploiting...

Vulnerability in the definition of the structure vba_vars_st{} in the drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h file – a driver for supporting Direct Rendering Infrastructure (DRI) in AMD graphics cards for Linux operating systems. This vulnerability allows attackers to cause system failures.

The vulnerability in the definition of the structure vbavarsst in the drivers/gpu/drm/amd/display/dc/dml/displaymodevba.h module exists. This vulnerability is related to unvalidated array indexing in the driver that supports Direct Rendering Infrastructure DRI for AMD graphics cards in Linux-base...

Vulnerability of the iwl_mvm_mld_rm_sta() function in the drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c module – The Linux kernel wireless adapter driver allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the iwlmvmmldrmsta function in the drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c file is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

The vulnerability of the snd_soc_put_volsw_sx() function in the sound/soc/soc-ops.c module of the Linux operating system’s audio support for SoC cores allows a hacker to cause a service failure.

The vulnerability of the sndsocputvolswsx function in the sound/soc/soc-ops.c module, which is part of the Linux operating system’s audio support for SoC cores, involves unvalidated array indexing. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2025-15921 · WordPress · Order Post

Name of the Vulnerable Software and Affected Versions: ORDER POST plugin for WordPress versions up to, and including, 2.0.2 Description: The ORDER POST plugin for WordPress is vulnerable to arbitrary shortcode execution due to the software allowing users to execute an action that does not properl...

CVE-2025-28407

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/dictId endpoint does not properly validate whether the requesting user has permission to modify the specified dictId...