CVE-2025-3124 Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized access to private repository names

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a user to see the names of private repositories that they wouldn't otherwise have access to in the Security Overview in GitHub Advanced Security. The Security Overview was required to be filtered only...

CLSA-2025-1744925221 gcc: Fix of CVE-2020-11023

CVE-2020-11023: Fix issue in DOM manipulation methods to prevent execution of untrusted code...

CVE-2021-47670

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: fix use after free bugs After calling peakusbnetifrxniskb, dereferencing skb is unsafe. Especially, the canframe cf which aliases skb memory is accessed after the peakusbnetifrxni. Reordering the lines solves the...

CVE-2021-47669

In the Linux kernel, the following vulnerability has been resolved: can: vxcan: vxcanxmit: fix use after free bug After calling netifrxniskb, dereferencing skb is unsafe. Especially, the canfdframe cfd which aliases skb memory is accessed after the netifrxni...

CVE-2021-47669 can: vxcan: vxcan_xmit: fix use after free bug

In the Linux kernel, the following vulnerability has been resolved: can: vxcan: vxcanxmit: fix use after free bug After calling netifrxniskb, dereferencing skb is unsafe. Especially, the canfdframe cfd which aliases skb memory is accessed after the netifrxni...

CVE-2020-36789 can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context

In the Linux kernel, the following vulnerability has been resolved: can: dev: cangetechoskb: prevent call to kfreeskb in hard IRQ context If a driver calls cangetechoskb during a hardware IRQ which is often, but not always, the case, the 'WARNONinirq' in net/core/skbuff.cskbreleaseheadstate might...

WordPress AdminQuickbar plugin <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin AdminQuickbar versions = 1.9.1...

WordPress WPCafe plugin <= 2.2.32 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by theviper17 Patchstack Alliance in WordPress Plugin WPCafe versions = 2.2.32...

WordPress Payment Form for PayPal Pro plugin <= 1.1.72 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Doan Dinh Van / Fore-Z co.ltd in WordPress Plugin Payment Form for PayPal Pro versions = 1.1.72...

PT-2025-17032 · Woocommerce · Akadrama Shipping With Venipak For Woocommerce

Name of the Vulnerable Software and Affected Versions: Akadrama Shipping with Venipak for WooCommerce versions 1.22.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS...

PT-2025-16976 · Webbernaut · Webbernaut Cloak Front End Email

Name of the Vulnerable Software and Affected Versions: webbernaut Cloak Front End Email versions 1.9.5 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. This can be exploited in th...

subfinder-2.7.0-2.1 on GA media (moderate)

subfinder-2.7.0-2.1 on GA media Announcement ID: openSUSE-SU-2025:15004-1 Rating: moderate Cross-References: CVE-2024-0406 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the subfinder-2.7.0-2...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : rubygem-bundler (SUSE-SU-2025:1294-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1294-1 advisory. - CVE-2020-36327: Fixed bundler choosing a dependency source based on the highest gem version number, whi...

PT-2025-17134 · Expresstechsoftware · Memberpress Discord Addon

Name of the Vulnerable Software and Affected Versions: expresstechsoftware MemberPress Discord Addon versions 1.1.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS...

Oracle Linux 7 : libreoffice (ELSA-2025-3390)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-3390 advisory. 5.3.6.1-26.0.3 - Fix CVE-2025-1080, do not process macros in exotic uri schemes Orabug: 37770225 Tenable has extracted the preceding description block directly...

PT-2025-17117 · WordPress · Wp Easy Poll

Name of the Vulnerable Software and Affected Versions: WP Easy Poll versions 2.2.9 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS in WP Easy Poll. Recommendations: For ...

CVE-2025-31201

CVE-2025-31201 is an Apple vulnerability that enables an attacker with arbitrary read/write capability to bypass Pointer Authentication. The issue is tied to the RPAC path and is fixed in iOS/iPadOS 18.4.1, tvOS 18.4.1, visionOS 2.4.1, and macOS Sequoia 15.4.1. Public records note high severity (...

CVE-2025-22122

In the Linux kernel, the following vulnerability has been resolved: block: fix adding folio to bio 4GB folio is possible on some ARCHs, such as aarch64, 16GB hugepage is supported, then 'offset' of folio can't be held in 'unsigned int', cause warning in bioaddfolionofail and IO failure. Fix it by...

CVE-2025-22123

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid accessing uninitialized curseg syzbot reports a f2fs bug as below: F2FS-fs loop3: Stopped filesystem due to reason: 7 kworker/u8:7: attempt to access beyond end of device BUG: unable to handle page fault for...

DEBIAN-CVE-2025-22116

In the Linux kernel, the following vulnerability has been resolved: idpf: check error for registernetdev on init Current init logic ignores the error code from registernetdev, which will cause WARNON on attempt to unregister it, if there was one, and there is no info for the user that the creatio...