PT-2025-22058 · Unknown · Bslthemes Tastyc

Name of the Vulnerable Software and Affected Versions: bslthemes Tastyc versions prior to 2.5.2 Description: The issue is related to a Path Traversal vulnerability, specifically a '.../...//' vulnerability, which allows PHP Local File Inclusion in bslthemes Tastyc. Recommendations: For versions...

Oracle Linux 8 : grafana (ELSA-2025-7894)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-7894 advisory. 9.2.10-23 - Resolves RHEL-89949: CVE-2025-4123 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...

PT-2025-21717 · Unknown · Uncanny Toolkit For Learndash

Name of the Vulnerable Software and Affected Versions: Uncanny Toolkit for LearnDash versions 3.7.0.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

PT-2025-21722 · Eventon · Eventon

Name of the Vulnerable Software and Affected Versions: EventON versions through 2.4.4 Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions through 2.4.4, update to a version...

PT-2025-21727 · Unknown · App Cheap Push Notification

Name of the Vulnerable Software and Affected Versions: App Cheap Push notification for Mobile and Web app versions n/a through 2.0.3 Description: The issue is related to a Missing Authorization vulnerability, which allows the exploitation of incorrectly configured access control security levels...

CVE-2025-37889

In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Consistently treat platformmax as control value This reverts commit 9bdd10d57a88 "ASoC: ops: Shift tested values in sndsocputvolsw by +min", and makes some additional related updates. There are two ways the platformmax...

CVE-2025-37876

In the Linux kernel, the following vulnerability has been resolved: netfs: Only create /proc/fs/netfs with CONFIGPROCFS When testing a special config: CONFIGNETFSSUPPORTS=y CONFIGPROCFS=n The system crashes with something like: 3.766197 ------------ cut here ------------ 3.766484 kernel BUG at...

CVE-2025-37871

In the Linux kernel, the following vulnerability has been resolved: nfsd: decrease sccount directly if fail to queue dlrecall A deadlock warning occurred when invoking nfs4putstid following a failed dlrecall queue operation: T1 T2 nfs4laundromat nfs4getclientreaplist nfs4anylockblockers breakleas...

CVE-2025-37855

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Guard Possible Null Pointer Dereference WHY In some situations, dc-respool may be null. HOW Check if pointer is null before dereference...

CVE-2025-37841

In the Linux kernel, the following vulnerability has been resolved: pm: cpupower: bench: Prevent NULL dereference on malloc failure If malloc returns NULL due to low memory, 'config' pointer can be NULL. Add a check to prevent NULL dereference...

CVE-2025-37886 pds_core: make wait_context part of q_info

In the Linux kernel, the following vulnerability has been resolved: pdscore: make waitcontext part of qinfo Make the waitcontext a full part of the qinfo struct rather than a stack variable that goes away after pdscadminqpost is done so that the context is still available after the wait loop has...

CVE-2025-37871 nfsd: decrease sc_count directly if fail to queue dl_recall

In the Linux kernel, the following vulnerability has been resolved: nfsd: decrease sccount directly if fail to queue dlrecall A deadlock warning occurred when invoking nfs4putstid following a failed dlrecall queue operation: T1 T2 nfs4laundromat nfs4getclientreaplist nfs4anylockblockers breakleas...

CVE-2025-37861

The CVE 2025-37861 pertains to the Linux kernel SCSI MPI3MR driver where the TM thread could process reply queues while the reset thread reinitializes them, causing an access to an invalid queue ID (0xFFFF) and a crash. The fix adds a synchronization flag io_admin_reset_sync. Before a reset, the ...

CVE-2025-37851

CVE-2025-37851 affects the Linux kernel fbdev omapfb path. The vulnerability centers on the dispc_ovl_setup function not handling the plane value OMAP_DSS_WB from the enum parameter plane. While that value is initialized in dss_init_overlays and in current code cannot take this value, some code p...

CVE-2025-37847

CVE-2025-37847: In the Linux kernel, a deadlock could occur in accel/ivpu during ivpu_ms_cleanup() when runtime resume acquires file_priv->ms_lock, leading to a cold boot path that calls ivpu_ms_cleanup_all(). The issue is resolved by preventing runtime resume after ms_lock is acquired, avoidi...

PT-2025-22225

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A bug in the Linux kernel's mm switching code causes TLB flushes to be suppressed in certain situations. This occurs due to a flaw in the should flush tlb function, which fails to send a...

CVE-2025-37831

In the Linux kernel, the following vulnerability has been resolved: cpufreq: apple-soc: Fix null-ptr-deref in applesoccpufreqgetrate cpufreqcpugetraw can return NULL when the target CPU is not present in the policy-cpus mask. applesoccpufreqgetrate does not check for this case, which results in a...

CVE-2025-37828 scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: mcq: Add NULL check in ufshcdmcqabort A race can occur between the MCQ completion path and the abort handler: once a request completes, blkmqfreerequest sets rq-mqhctx to NULL, meaning the subsequent ufshcdmcqreqtohwq...

CVE-2025-37824

CVE-2025-37824 affects the Linux kernel TIPC monitor path. The issue is a NULL pointer dereference in tipc_mon_reinit_self() caused by a race between enabling and disabling the bearer, where mon->self may be NULL during reinitialization. A fix has been applied in tipc_mon_reinit_self() (net/ti...

CVE-2025-37822

In the Linux kernel, the following vulnerability has been resolved: riscv: uprobes: Add missing fence.i after building the XOL buffer The XOL execute out-of-line buffer is used to single-step the replaced instructions for uprobes. The RISC-V port was missing a proper fence.i i$ flushing after...