PT-2025-51231

NetSupport Manager 14.12.0001 contains an unauthenticated SQL injection vulnerability in its Connectivity Server/Gateway HTTPS request handling. The server evaluates request URIs using an unsanitized SQLite query against the FileLinks table in gateway.db. By injecting SQL through the LinkName/URI...

CVE-2025-65779

An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Unauthenticated attackers can update a board's "sort" value Boards.allow returns true without verifying userId, allowing arbitrary reordering of boards...

CVE-2025-65779

An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Unauthenticated attackers can update a board's "sort" value Boards.allow returns true without verifying userId, allowing arbitrary reordering of boards...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the qla4xxxgetepfwdb function in the qla4xxx driver for Linux kernel involves insufficient checking of return values. Exploiting this vulnerability allows attackers to cause system failures...

Linux fs/nfsd/nfs4state.c DoS

The vulnerability of the fs/nfsd/nfs4state.c component in the Linux operating system is related to an unvalidated return value. Exploiting this vulnerability allows an attacker to cause a service failure...

Linux kernel net/sched DoS

The vulnerability of the net/sched component in the Linux operating system’s kernel is related to an unvalidated return value. Exploiting this vulnerability allows an attacker to cause a service failure...

WeKan security vulnerabilities

WeKan is a Kanban application from the WeKan open source. A security vulnerability exists in WeKan versions 18.15 and earlier, which stems from an unauthenticated attacker being able to update the board's sort value, potentially leading to arbitrary reordering...

Linux kernel Improper Return Value DoS

The vulnerability of the Linux operating system’s kernel is related to improper checking of the return value of a function. Exploiting this vulnerability allows an attacker to cause service failures...

graphicsmagick:enhance_fuzzer: Use-of-uninitialized-value in TIFFReadDirectory

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=6173944400117760 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: enhancefuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type: Use-of-uninitialized-value Cra...

CVE-2025-14667

A security vulnerability has been detected in itsourcecode COVID Tracking System 1.0. The impacted element is an unknown function of the file /admin/?page=systeminfo. Such manipulation of the argument metavalue leads to sql injection. The attack may be performed from remote. The exploit has been...

kimageformats:kimgio_heif_fuzzer: Use-of-uninitialized-value in put_weighted_pred_8_fallback

Project: git://anongit.kde.org/kimageformats Detailed Report: https://oss-fuzz.com/testcase?key=4652958001463296 Project: kimageformats Fuzzing Engine: libFuzzer Fuzz Target: kimgioheiffuzzer Job Type: libfuzzermsankimageformats Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

ITSsourcecode COVID Tracking System SQL Injection Vulnerability

itsourcecode COVID Tracking System is a new coronavirus tracking system open-sourced by itsourcecode. An SQL injection vulnerability exists in version 1.0 of itsourcecode COVID Tracking System, which stems from an incorrect manipulation of the parameter metavalue in the file...

Authentication Bypass

robrichards/xmlseclibs is vulnerable to authentication bypass. The vulnerability is due to improper handling in the libxml2 canonicalization process where invalid XML inputs may return an empty string, which allows an attacker to bypass authentication by manipulating the DigestValue computation...

CVE-2025-14440 JAY Login & Register <= 2.4.01 - Authentication Bypass via Cookie

The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authentication checking in the 'jayloginregisterprocessswitchback' function with the 'jayloginregisterprocessswitchback' cookie value. This makes...

CVE-2025-64721

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.6 and below, the SYSTEM-level service SbieSvc.exe exposes SbieIniServer::RC4Crypt to sandboxed processes. The handler adds a fixed header size to a caller-controlled valuelen...

bitcoin-core:crypto_hkdf_hmac_sha256_l32: Use-of-uninitialized-value in LLVMFuzzerInitialize

Detailed Report: https://oss-fuzz.com/testcase?key=6498736437264384 Project: bitcoin-core Fuzzing Engine: libFuzzer Fuzz Target: cryptohkdfhmacsha256l32 Job Type: libfuzzermsanbitcoin-core Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: LLVMFuzzerInitialize...

OESA-2025-2831 glib-networking security update

glib-networking contains the implementations of certain GLib networking features that cannot be implemented directly in GLib itself because of their dependencies. Security Fixes: glib-networking s OpenSSL backend fails to properly check the return value of memory allocation routines. An out of...

OESA-2025-2802 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix uninit-value in ncirxwork syzbot reported the following uninit-value access issue 1 ncirxwork parses received packet from ndev-rxq. It should be...

WordPress Plugin Events Manager Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site request...

CVE-2025-64721 Sandboxie's Integer Overflow in SbieIniServer::RC4Crypt allows sandbox escape and SYSTEM compromise

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.6 and below, the SYSTEM-level service SbieSvc.exe exposes SbieIniServer::RC4Crypt to sandboxed processes. The handler adds a fixed header size to a caller-controlled valuelen...