CVE-2025-8074

Origin validation error vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.3-13973 allows local users to write arbitrary files with non-sensitive information via unspecified vectors...

CVE-2025-65958 Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Server-Side Request Forgery SSRF vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to the lack of a security header on certain user-uploaded content served from repositories. An attacker can execute arbitrary scripts in the context of another user by uploading specially crafted content and...

📄 Microsoft Windows 11 Administrator Protection UAC Bypass / Privilege Escalation

A privilege escalation vulnerability exists in Windows 11 Insider Preview Build 10.0.27919.1000 due to improper handling of user‑controlled environment variables by the Unified Background Process Manager UBPM when launching elevated scheduled tasks under Administrator Protection. Proof of concept...

CVE-2025-13354 Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Taxonomy Term Manipulation

The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.40.1. This is due to the plugin not properly verifying that a user is authorized to perform an action in the...

Tagify - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-121

This module enables you to use the Tagify library to enhance text input fields with tag-style UI elements. The module does not sufficiently sanitize the infoLabel value under certain configurations, which can result in a cross-site scripting XSS vulnerability. This vulnerability is mitigated by t...

RockyLinux 8 : redis:6 (RLSA-2025:19238)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:19238 advisory. redis: Lua library commands may lead to integer overflow and potential RCE CVE-2025-46817 Redis: Redis: Authenticated users can execute LUA scripts as a...

CVE-2025-13870 Unauthorized access and subscription vulnerability in Boards

Mattermost versions 10.11.x = 10.11.4, 10.5.x = 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards, which allows an authenticated user to access other board files and was able to subscribe to the block from other boards that the user does...

CVE-2024-45675

IBM Informix Dynamic Server 14.10 could allow a local user on the system to log into the Informix server as administrator without a password...

PT-2025-48780

NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions, which in certain deployment scenarios can enable users on client workstations to modify the program executables and libraries...

CVE-2025-49642

Library loading on AIX Zabbix Agent builds can be hijacked by local users with write access to the /home/cecuser directory...

CVE-2025-49642 Agent builds for AIX vulnerable to library loading hijacking

Library loading on AIX Zabbix Agent builds can be hijacked by local users with write access to the /home/cecuser directory...

CVE-2025-8045

Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU processing operations to gain access to already freed memory.This issue affects Valhall GPU Kernel Driver: from...

kernel: e1000e: fix heap overflow in e1000_set_eeprom

A heap‑overflow vulnerability was discovered in the linux kernel e1000e driver’s e1000seteeprom function, insufficient validation of the requested length for an EEPROM change could allow a local, low‑privilege user to trigger memory corruption heap overflow. A local unprivileged user with access ...

CVE-2025-8045

CVE-2025-8045 is a local, use-after-free vulnerability affecting Arm Valhall GPU Kernel Driver and Arm 5th Gen GPU Architecture Kernel Driver. The issue allows a local non-privileged process to cause improper GPU processing and gain access to previously freed memory. Affected ranges: Valhall GPU ...

CVE-2025-2879

CVE-2025-2879 affects Arm Valhall GPU Kernel Driver and Arm 5th Gen GPU Architecture Kernel Driver. A local, non-privileged user could perform improper GPU processing operations to expose sensitive data. Affected versions: Valhall: r29p0–r49p4 and r50p0–r54p0; Arm 5th Gen: r41p0–r49p4 and r50p0–r...

ASB-A-326926596

In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

ASB-A-305710469

In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2025-48443

Name of the Vulnerable Software and Affected Versions Zabbix Agent versions affected versions not specified Description The Zabbix Agent builds on AIX are susceptible to a library loading hijacking issue. Local users possessing write access to the /home/cecuser directory can exploit this to hijac...

PT-2025-48437

Name of the Vulnerable Software and Affected Versions Arm Ltd Valhall GPU Kernel Driver versions r53p0 through r54p1 Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver versions r53p0 through r54p1 Description A Use After Free issue exists in the Arm Ltd Valhall GPU Kernel Driver and Arm Ltd Arm 5...