13689 matches found
CVE-2025-40232 rv: Fully convert enabled_monitors to use list_head as iterator
In the Linux kernel, the following vulnerability has been resolved: rv: Fully convert enabledmonitors to use listhead as iterator The callbacks in enabledmonitorsseqops are inconsistent. Some treat the iterator as struct rvmonitor , while others treat the iterator as struct listhead . This causes...
CVE-2025-40217 pidfs: validate extensible ioctls
In the Linux kernel, the following vulnerability has been resolved: pidfs: validate extensible ioctls Validate extensible ioctls stricter than we do now...
kernel: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix use-after-free of work objects after cmid destruction The commit 59c68ac31e15 "iwcm: free cmid resources on the last deref" simplified cmid resource management by freeing cmid once all references to the cmid were...
Oracle Linux 10 : kea (ELSA-2025-21038)
The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-21038 advisory. - Fixes CVE-2025-11232 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not tested...
SUSE SLES12 Security Update : cups (SUSE-SU-2025:4289-1)
The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:4289-1 advisory. - CVE-2025-61915: Fixed local denial-of-service via cupsd.conf update bsc1253783 Tenable has extracted the preceding description block directly from th...
Oracle Linux 10 : ELSA-2025-20155-0: / binutils (ELSA-2025-201550)
The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-201550 advisory. - Remove workaround for CVE-2025-5702. RHEL-100159 - Add fix for CVE-2025-5244. RHEL-100417 - USe correct fix for CVE-2025-5702. RHEL-100159 Tenable has...
Advisory ROSA-SA-2025-3093
Software: sudo 1.8.23 OS: rosa-server79 unaffected versions = sudo-1.8.23-11.0.2.res7.3 affected versions sudo-1.8.23-11.0.2.2.res7.3 CVE-ID: CVE-2025-32462 BDU-ID: 2025-08356 CVE-Crit: LOW CVE-DESC.: A vulnerability in the Sudo system administration program is related to a flaw in the...
CVE-2025-12483
The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'query' parameter in all versions up to, and including, 3.11.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2025-66306
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, there is an IDOR Insecure Direct Object Reference vulnerability in the Grav CMS Admin Panel which allows low-privilege users to access sensitive information from other accounts. Although direct account takeover is not possible, admin emai...
CVE-2025-66312
The CVE-2025-66312 pertains to Grav Admin Plugin, where a Stored XSS vulnerability existed in the /admin/accounts/groups/Grupo endpoint via the data[readableName] field. The issue allowed injected scripts to be stored on the server and executed when affected pages load. It affects Grav’s admin in...
CVE-2025-66307 Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure
This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a user enumeration and email disclosure vulnerability exists in Grav. The "Forgot Password" functionality at /admin/forgot leaks...
CVE-2025-66299 Security Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection SSTI that allows any authenticated user with editor permissions to execute arbitrary code on the remote server, bypassing the existing security sandbox. Since the security sandbox...
Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.20.4 release and security update
An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more information...
CVE-2025-66294 Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection SSTI vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by...
PT-2025-48579
Name of the Vulnerable Software and Affected Versions fastify-reply-from versions prior to 12.5.0 Description fastify-reply-from is a Fastify plugin used to forward HTTP requests to another server. Versions of the plugin prior to 12.5.0 contain a flaw where a malicious URL can be crafted to allow...
PT-2025-48551
Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.8.0-beta.27 Description Grav is a file-based Web platform. A user with user creation privileges can create a new user through the Admin UI and, by supplying a username containing path traversal sequences for example...
PT-2025-48568
Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.11.0-beta.1 Description The Grav admin plugin, an HTML user interface for configuring Grav and managing pages, contains a Reflected Cross-Site Scripting XSS issue. An attacker can inject malicious scripts through the...
PT-2025-48566
Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.8.0-beta.27 Grav versions prior to 1.11.0-beta.1 Description The Grav admin plugin, a user interface for configuring Grav, contains a flaw in its "Forgot Password" functionality. Specifically, the functionality at the...
[SECURITY] [DLA 4365-2] unbound security update
Debian LTS Advisory DLA-4365-2 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin November 30, 2025 https://wiki.debian.org/LTS Package : unbound Version : 1.13.1-1+deb11u7 CVE ID : CVE-2025-11411 Debian Bug : 1121446 Yuxiao Wu, Yunyi Zhang, Baojun Liu and Haixin Duan...