CVE-2025-24159

Summary: CVE-2025-24159 is a kernel-level validation issue that may allow an app to execute arbitrary code with kernel privileges. Affected platforms (per provided docs): iPadOS 17.7.4, macOS Sonoma 14.7.3, visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Impac...

CVE-2025-24159

A validation issue was addressed with improved logic. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, tvOS 18.3, visionOS 2.3, watchOS 11.3. An app may be able to execute arbitrary code with kernel privileges...

Relative Path Traversal

github.com/hashicorp/go-slug is vulnerable to Relative Path Traversal. The vulnerability is due to improper path validation when extracting user-provided paths from tar entries, allowing for directory traversal and potential overwriting of arbitrary files...

macOS 14.x < 14.7.3 Multiple Vulnerabilities (122069)

The remote host is running a version of macOS / Mac OS X that is 14.x prior to 14.7.3. It is, therefore, affected by multiple vulnerabilities: - An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Ventura 13.7.3, macOS Sonoma 14.7.3, visionOS 2.3, iOS...

PT-2025-5327

Name of the Vulnerable Software and Affected Versions visionOS versions prior to 2.3 Safari versions prior to 18.3 iOS versions prior to 18.3 iPadOS versions prior to 18.3 macOS Sequoia versions prior to 15.3 watchOS versions prior to 11.3 tvOS versions prior to 18.3 Description Processing...

About the security content of tvOS 18.3

About the security content of tvOS 18.3 This document describes the security content of tvOS 18.3. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

CVE-2024-11641

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to change plugi...

CVE-2024-40693 IBM Planning Analytics file upload

IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. Attackers can make use of this weakness and upload malicious executable files into the system, and it can be sent to victim for performing furth...

[SECURITY] [DLA 4029-1] frr security update

From: Arturo Borrero Gonzalez [email protected] To: [email protected] Subject: SECURITY DLA 4029-1 frr security update - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4029-1 [email protected]...

PT-2025-4839 · Github · Github

Name of the Vulnerable Software and Affected Versions: matrix-hookshot versions 5.4.1 and earlier matrix-hookshot versions 6.0.1 and earlier Description: The issue is related to a Denial of Service DoS condition that can occur when the software is configured with GitHub support. This happens due ...

Moderate: Red Hat Security Advisory: Red Hat OpenStack Platform 18.0.4 (openstack-ironic) security update

An update for openstack-ironic is now available for Red Hat OpenStack Platform 18.0.4 Antelope. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CVE-2025-23846

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in thaikolja Flexible Blogtitle flexible-blogtitle allows Reflected XSS.This issue affects Flexible Blogtitle: from n/a through = 0.1...

CVE-2025-23607

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Camoo Sarl CAMOO SMS camoo-sms allows Reflected XSS.This issue affects CAMOO SMS: from n/a through = 3.0.1...

PT-2025-5016 · Localgrid · Localgrid

Name of the Vulnerable Software and Affected Versions: LocalGrid versions n/a through 1.0.1 Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This enables an attacker to inject malicious scripts into ...

CVE-2025-24013 CodeIgniter validation of header name and value

CodeIgniter is a PHP full-stack web framework. Prior to 4.5.8, CodeIgniter lacked proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with Header class. This could disrupt application functionality, potentially causing errors or...

CVE-2025-21653

In the Linux kernel, the following vulnerability has been resolved: netsched: clsflow: validate TCAFLOWRSHIFT attribute syzbot found that TCAFLOWRSHIFT attribute was not validated. Right shitfing a 32bit integer is undefined for large shift values. UBSAN: shift-out-of-bounds in...

CVE-2024-41783

IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.1.0.0, and 6.2.0.0 could allow a privileged user to inject commands into the underlying operating system due to improper validation of a specified type of input...

CVE-2024-41783 IBM Sterling Secure Proxy improper input validation

IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.1.0.0, and 6.2.0.0 could allow a privileged user to inject commands into the underlying operating system due to improper validation of a specified type of input...

CVE-2024-45654

IBM Security ReaQta 3.12 is affected by CVE-2024-45654 due to reliance on untrusted inputs, enabling an authenticated user to perform unauthorized actions. The IBM advisory for QRadar EDR (version 3.12) documents the root cause as input validation relying on untrusted inputs and lists the affecte...

CVE-2024-13317

CVE-2024-13317 affects the ShipWorks Connector for Woocommerce (WordPress) up to version 5.2.5. Root cause: missing/incorrect nonce validation on the shipworks-wordpress page enabling CSRF. Impact: unauthenticated attackers could update the service credentials (username/password) by forging reque...