AZL-76119 CVE-2026-22795 affecting package edk2 for versions less than 20230301gitf80f052277c8-47

Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS12 file. Impact summary: An application processing a malformed PKCS12 file can be caused to dereference an invalid or NULL pointer on memory read, resulting in a Denial of Service. A type...

CVE-2026-24595 WordPress Zoho CRM Lead Magnet plugin <= 1.8.1.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in zohocrm Zoho CRM Lead Magnet zoho-crm-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zoho CRM Lead Magnet: from n/a through = 1.8.1.9...

PT-2025-53670

Name of the Vulnerable Software and Affected Versions PbootCMS versions prior to 3.2.12 Description A security issue exists in PbootCMS that allows for remote manipulation of the X-Forwarded-For argument. This manipulation impacts the get user ip function within the core/function/handle.php file,...

CVE-2025-63037

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DFDevelopment Ronneby Theme Core ronneby-core allows DOM-Based XSS.This issue affects Ronneby Theme Core: from n/a through = 1.5.68...

CVE-2025-40936

Summary: CVE-2025-40936 affects Siemens PS/IGES Parasolid Translator Component versions prior to 29.0.258. The connected ZDI advisory (ZDI-25-1042) specifies an out-of-bounds read during IGS file parsing, which can crash the host application or allow arbitrary code execution in the current proces...

AZL-64604 CVE-2025-38149 affecting package kernel for versions less than 6.6.96.1-1

In the Linux kernel, the following vulnerability has been resolved: net: phy: clear phydev-devlink when the link is deleted There is a potential crash issue when disabling and re-enabling the network port. When disabling the network port, phydetach calls devicelinkdel to remove the device link, b...

CVE-2025-1686

Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates that leverage this tag to include files...

PDF Invoices & Packing Slips for WooCommerce 信息泄露漏洞

PDF Invoices & Packing Slips for WooCommerce is a WP Overnight open source tool for creating, printing, and automatically sending PDF invoices for WooCommerce orders. An information disclosure vulnerability exists in PDF Invoices & Packing Slips for WooCommerce versions prior to 4.0.0, which stem...

AZL-55658 CVE-2024-12088 affecting package rsync for versions less than 3.4.1-1

A flaw was found in rsync. When using the --safe-links option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the...

WordPress ElementInvader Addons for Elementor plugin <= 1.2.6 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin ElementInvader Addons for Elementor versions = 1.2.6...

AZL-55340 CVE-2024-56776 affecting package kernel for versions less than 6.6.64.2-1

In the Linux kernel, the following vulnerability has been resolved: drm/sti: avoid potential dereference of error pointers The return value of drmatomicgetcrtcstate needs to be checked. To avoid use of error pointer 'crtcstate' in case of the failure...

AZL-55032 CVE-2024-56758 affecting package kernel for versions less than 6.6.96.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: check folio mapping after unlock in relocateonefolio When we call btrfsreadfolio to bring a folio uptodate, we unlock the folio. The result of that is that a different thread can modify the mapping like remove it with...

AZL-55280 CVE-2024-56722 affecting package kernel for versions less than 6.6.64.2-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix cpu stuck caused by printings during reset During reset, cmd to destroy resources such as qp, cq, and mr may fail, and error logs will be printed. When a large number of resources are destroyed, there will be lots o...

AZL-54437 CVE-2024-45338 affecting package influxdb for versions less than 2.7.3-9

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

AZL-53420 CVE-2024-50195 affecting package kernel for versions less than 6.6.64.2-1

In the Linux kernel, the following vulnerability has been resolved: posix-clock: Fix missing timespec64 check in pcclocksettime As Andrew pointed out, it will make sense that the PTP core checked timespec64 struct's tvsec and tvnsec range before calling ptp-info-settime64. As the man manual of...

AZL-49835 CVE-2024-46860 affecting package kernel for versions less than 6.6.56.1-5

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix NULL pointer access in mt7921ipv6addrchange When disabling wifi mt7921ipv6addrchange is called as a notifier. At this point mvif-phy is already NULL so we cannot use it here...

PT-2024-28220 · Unknown · Codection Import/Export Users/Customers

Name of the Vulnerable Software and Affected Versions: Codection Import and export users and customers versions n/a through 1.26.8 Description: The issue allows exposure of sensitive information to an unauthorized actor due to accessing functionality not properly constrained by ACLs. This affects...

AZL-34684 CVE-2023-52426 affecting package expat for versions less than 2.6.2-1

libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time...

AZL-35384 CVE-2023-51258 affecting package yasm for versions less than 1.3.0-16

A memory leak issue discovered in YASM v.1.3.0 allows a local attacker to cause a denial of service via the newToken function in the modules/preprocs/nasm/nasm-pp:1512...

SUSE CVE-2023-49438

An open redirect vulnerability in the python package Flask-Security-Too =5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes...