PT-2025-17449 · Cilium · Cilium

Name of the Vulnerable Software and Affected Versions: Cilium versions 1.15.0 through 1.15.15 Cilium versions 1.16.0 through 1.16.8 Cilium versions 1.17.0 through 1.17.2 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. When using Wireguard...

CVE-2025-43919

GNU Mailman 2.1.39, as bundled in cPanel and WHM, allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman aka the private archive authentication endpoint via the username parameter. NOTE: multiple third parties report that they are unable t...

CVE-2025-38575

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use aeadrequestfree to match aeadrequestalloc Use aeadrequestfree instead of kfree to properly free memory allocated by aeadrequestalloc. This ensures sensitive crypto data is zeroed before being freed...

Updated rust packages fix security vulnerability

The Rust Security Response WG was notified that the Rust standard library did not properly escape arguments when invoking batch files with the bat and cmd extensions on Windows using the Command API. An attacker able to control the arguments passed to the spawned process could execute arbitrary...

PT-2025-17006 · WordPress · Wplike2Get

Name of the Vulnerable Software and Affected Versions: wpLike2Get versions 1.2.9 and earlier Description: The issue allows exposure of sensitive system information to an unauthorized control sphere, enabling the retrieval of embedded sensitive data. Recommendations: For wpLike2Get versions 1.2.9...

PT-2025-17060 · Unknown · Wpion Live Css

Name of the Vulnerable Software and Affected Versions: wpion Live css versions 1.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-17081 · Unknown · Firedrum Email Marketing

Name of the Vulnerable Software and Affected Versions: FireDrum Email Marketing versions 1.64 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers ...

PT-2025-17041 · Unknown · Empty Tags Remover

Name of the Vulnerable Software and Affected Versions: Empty Tags Remover versions 1.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inje...

PT-2025-16969 · Unknown · Stylish Google Sheet Reader

Name of the Vulnerable Software and Affected Versions: Stylish Google Sheet Reader versions n/a through 4.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attacker...

PT-2025-17087 · Event Espresso · Event Espresso – Custom Email Template Shortcode

Name of the Vulnerable Software and Affected Versions: Event Espresso – Custom Email Template Shortcode versions 1.0.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS in...

PT-2025-17136 · Unknown · Movylo Marketing Automation

Name of the Vulnerable Software and Affected Versions: Movylo Marketing Automation versions through 2.0.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker c...

PT-2025-17103 · Unknown · Arconix Faq

Name of the Vulnerable Software and Affected Versions: Arconix FAQ versions 1.9.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inject...

perl-32bit-5.40.2-1.1 on GA media (moderate)

perl-32bit-5.40.2-1.1 on GA media Announcement ID: openSUSE-SU-2025:15003-1 Rating: moderate Cross-References: CVE-2024-56406 CVSS scores: CVE-2024-56406 SUSE : 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2024-56406 SUSE : 8.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA...

CVE-2025-22087

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix array bounds error with maygoto maygoto uses an additional 8 bytes on the stack, which causes the interpreters array to go out of bounds when calculating index by stacksize. 1. If a BPF program is rewritten, re-evaluate...

CVE-2025-22075

In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Allocate vfinfo size for VF GUIDs when supported Commit 30aad41721e0 "net/core: Add support for getting VF GUIDs" added support for getting VF port and node GUIDs in netlink ifinfo messages, but their size was not take...

CVE-2025-22104

In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Use kernel helpers for hex dumps Previously, when the driver was printing hex dumps, the buffer was cast to an 8 byte long and printed using string formatters. If the buffer size was not a multiple of 8 then a read buffe...

CVE-2025-22061

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix qid report in airohatcgethtbgetleafqueue Fix the following kernel warning deleting HTB offloaded leafs and/or root HTB qdisc in airohaeth driver properly reporting qid in airohatcgethtbgetleafqueue routine. $tc...

CVE-2025-22033

In the Linux kernel, the following vulnerability has been resolved: arm64: Don't call NULL in docompatalignmentfixup doalignmentt32tohandler only fixes up alignment faults for specific instructions; it returns NULL otherwise e.g. LDREX. When that's the case, signal to the caller that it needs to...

CVE-2025-22039

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix overflow in dacloffset bounds check The dacloffset field was originally typed as int and used in an unchecked addition, which could overflow and bypass the existing bounds check in both smbcheckpermdacl and...

CVE-2025-22054

In the Linux kernel, the following vulnerability has been resolved: arcnet: Add NULL check in com20020pciprobe devmkasprintf returns NULL when memory allocation fails. Currently, com20020pciprobe does not check for this case, which results in a NULL pointer dereference. Add NULL check after...