CVEs published February 27, 2025
275 CVEs were published on February 27, 2025: 19 critical, 112 high.
- Published
- 275
- Critical
- 19
- High
- 112
- Medium
- 70
- Low
- 10
- Unrated
- 64
- Now in CISA KEV
- 0
- Fix available
- 113
Most affected products
- Linux
- 176
- IBM EntireX
- 10
- MongoDB mongosh · mongosh
- 4
- ThemeMakers Car Dealer Automotive WordPress Theme – Respons…
- 4
- mastodon
- 2
- Trivision Camera NC227WF
- 2
- Acronis Backup plugin for cPanel & WHM · Acronis Backup ext…
- 1
- ATISoluciones CIGES
- 1
- b1gMail
- 1
- Boss Media BuddyBoss Platform
- 1
Critical 19
- CVE-2025-21805RDMA/rtrs: Add missing deinit() callLinux
- CVE-2024-13148SQLi in Yukseloglu Filter's B2B Login PlatformYukseloglu Filter B2B Login Platform
- CVE-2025-1751SQL Injection CIGESATISoluciones CIGES
- CVE-2025-21796nfsd: clear acl_access/acl_default after releasing themLinux
- CVE-2025-21748ksmbd: fix integer overflows on 32 bit systemsLinux
- CVE-2024-58006PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()Linux
- CVE-2025-21707mptcp: consolidate suboption statusLinux
- CVE-2024-36046Infoblox NIOS through 8.6.4 executes with more privileges than required.
- CVE-2024-36047Infoblox NIOS through 8.6.4 and 9.x through 9.0.3 has Improper Input Validation.
- CVE-2024-37566Infoblox NIOS through 8.6.4 has Improper Authentication for Grids.
- CVE-2024-37567Infoblox NIOS through 8.6.4 has Improper Access Control for Grids.
- CVE-2024-38292In Extreme Networks XIQ-SE before 24.2.11, due to a missing access control check, a path traversal is possible, which may lead to privilege
- CVE-2024-51138Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2862/2926 3.9.9.5 and earlier;
- CVE-2024-51139Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and ea
- CVE-2024-53944An issue was discovered on Tuoshi/Dionlink LT15D 4G Wi-Fi devices through M7628NNxlSPv2xUI_v1.0.1802.10.08_P4 and LT21B devices through M762
- CVE-2024-55160GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list.
- CVE-2025-22952elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can begithub.com/usememos/memos
- CVE-2025-25570Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials.
- CVE-2025-26325ShopXO 6.4.0 is vulnerable to File Upload in ThemeDataService.php.
High 112
- CVE-2024-12811Traveler <= 3.1.9 - Authenticated (Contributor+) Local File Inclusion via ShortcodeShineTheme Travel Booking WordPress Theme
- CVE-2025-1687Cardealer <= 1.6.4 - Cross-Site Request Forgery to User Update via update_user_profileThemeMakers Car Dealer Automotive WordPress Theme – Respons…
- CVE-2025-1682Cardealer <= 1.6.4 - Arbitrary Theme Option Update to Authenticated (Subscriber+) Privilege EscalationThemeMakers Car Dealer Automotive WordPress Theme – Respons…
- CVE-2025-21823batman-adv: Drop unmanaged ELP metric workerLinux
- CVE-2025-21812ax25: rcu protect dev->ax25_ptrLinux
- CVE-2025-21811nilfs2: protect access to buffers with no active referencesLinux
- CVE-2025-21810driver core: class: Fix wild pointer dereferences in API class_dev_iter_next()Linux
- CVE-2025-21809rxrpc, afs: Fix peer hash locking vs RCU callbackLinux
- CVE-2025-21808net: xdp: Disallow attaching device-bound programs in generic modeLinux
- CVE-2025-21804PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region()Linux
- CVE-2025-21801net: ravb: Fix missing rtnl lock in suspend/resume pathLinux
- CVE-2024-58034memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()Linux
- CVE-2025-23687WordPress Woo Store Mode plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilitysimonhunter Woo Store Mode
- CVE-2025-1756MongoDB Shell may be susceptible to local privilege escalation in WindowsMongoDB mongosh · mongosh
- CVE-2025-1755MongoDB Compass may be susceptible to local privilege escalation in WindowsMongoDB Compass
- CVE-2025-22280WordPress DefendWP Firewall Plugin <= 1.1.0 - Broken Access Control vulnerabilityrevmakx DefendWP Firewall
- CVE-2024-9334Information Disclosure in E-Kent's Pallium Vehicle TrackingE-Kent Pallium Vehicle Tracking
- CVE-2025-27154Spotipy's cache file, containing spotify auth token, is created with overly broad permissionsspotipy-dev spotipy · spotipy
- CVE-2025-1739Multiple vulnerabilities in Trivision Camera NC227WFTrivision Camera NC227WF
- CVE-2025-1691MongoDB Shell may be susceptible to Control Character Injection via autocompleteMongoDB mongosh · mongosh
- CVE-2025-1282Car Dealer Automotive WordPress Theme – Responsive <= 1.6.3 - Authenticated (Subscriber+) Arbitrary File Deletion and ReadThemeMakers Car Dealer Automotive WordPress Theme – Respons…
- CVE-2025-1717Login Me Now <= 1.7.2 - Authentication Bypasspluginly Login Me Now – Passwordless, Magic Link, OTP & Soc…
- CVE-2024-2297Bricksbuilder <= 1.9.6.1 - Authenticated (Contributor+) Privilege Escalation via create_autosaveBricks Builder Bricks
- CVE-2025-1295Templines Elementor Helper Core <= 2.7 - Authenticated (Subscriber+) Privilege EscalationTemplines Elementor Helper Core
- CVE-2025-21797HID: corsair-void: Add missing delayed work cancel for headset statusLinux
- CVE-2025-21795NFSD: fix hang in nfsd4_shutdown_callbackLinux
- CVE-2025-21794HID: hid-thrustmaster: fix stack-out-of-bounds read in usb_check_int_endpoints()Linux
- CVE-2025-21792ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockoptLinux
- CVE-2025-21791vrf: use RCU protection in l3mdev_l3_out()Linux
- CVE-2025-21789LoongArch: csum: Fix OoB access in IP checksum code for negative lengthsLinux
- CVE-2025-21788net: ethernet: ti: am65-cpsw: fix memleak in certain XDP casesLinux
- CVE-2025-21786workqueue: Put the pwq after detaching the rescuer from the poolLinux
- CVE-2025-21785arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo arrayLinux
- CVE-2025-21780drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()Linux
- CVE-2025-21778tracing: Do not allow mmap() of persistent ring bufferLinux
- CVE-2025-21772partitions: mac: fix handling of bogus partition tableLinux
- CVE-2025-21766ipv4: use RCU protection in __ip_rt_update_pmtu()Linux
- CVE-2025-21765ipv6: use RCU protection in ip6_default_advmss()Linux
- CVE-2025-21764ndisc: use RCU protection in ndisc_alloc_skb()Linux
- CVE-2025-21763neighbour: use RCU protection in __neigh_notify()Linux
- CVE-2025-21762arp: use RCU protection in arp_xmit()Linux
- CVE-2025-21761openvswitch: use RCU protection in ovs_vport_cmd_fill_info()Linux
- CVE-2025-21760ndisc: extend RCU protection in ndisc_send_skb()Linux
- CVE-2025-21759ipv6: mcast: extend RCU protection in igmp6_send()Linux
- CVE-2025-21758ipv6: mcast: add RCU protection to mld_newpack()Linux
- CVE-2025-21756vsock: Keep the binding until socket destructionLinux · :linux_kernel:
- CVE-2024-54458scsi: ufs: bsg: Set bsg_queue to NULL after removalLinux
- CVE-2024-54456NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()Linux
- CVE-2024-52560fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()Linux
- CVE-2024-52559drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()Linux
- CVE-2024-49570drm/xe/tracing: Fix a potential TP_printk UAFLinux
- CVE-2025-21753btrfs: fix use-after-free when attempting to join an aborted transactionLinux
- CVE-2025-21751net/mlx5: HWS, change error flow on matcher disconnectLinux
- CVE-2025-21743usbnet: ipheth: fix possible overflow in DPE length checkLinux
- CVE-2025-21742usbnet: ipheth: use static NDP16 location in URBLinux
- CVE-2025-21741usbnet: ipheth: fix DPE OoB readLinux
- CVE-2025-21739scsi: ufs: core: Fix use-after free in init error and remove pathsLinux
- CVE-2025-21738ata: libata-sff: Ensure that we cannot write outside the allocated bufferLinux
- CVE-2025-21735NFC: nci: Add bounds checking in nci_hci_create_pipe()Linux
- CVE-2025-21734misc: fastrpc: Fix copy buffer page sizeLinux
- CVE-2024-58019nvkm/gsp: correctly advance the read pointer of GSP message queueLinux
- CVE-2024-58013Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_syncLinux
- CVE-2024-58010binfmt_flat: Fix integer overflow bug on 32 bit systemsLinux
- CVE-2024-58008KEYS: trusted: dcp: fix improper sg use with CONFIG_VMAP_STACK=yLinux
- CVE-2024-58004media: intel/ipu6: remove cpu latency qos request on errorLinux
- CVE-2024-58003media: i2c: ds90ub9x3: Fix extra fwnode_handle_put()Linux
- CVE-2024-58002media: uvcvideo: Remove dangling pointersLinux
- CVE-2025-21731nbd: don't allow reconnect after disconnectLinux
- CVE-2025-21730wifi: rtw89: avoid to init mgnt_entry list twice when WoWLAN failedLinux
- CVE-2025-21729wifi: rtw89: fix race between cancel_hw_scan and hw_scan completionLinux
- CVE-2025-21727padata: fix UAF in padata_reorderLinux
- CVE-2025-21726padata: avoid UAF for reorder_workLinux
- CVE-2025-21725smb: client: fix oops due to unset link speedLinux
- CVE-2025-21722nilfs2: do not force clear folio if buffer is referencedLinux
- CVE-2025-21720xfrm: delete intermediate secpath entry in packet offload modeLinux
- CVE-2025-21719ipmr: do not call mr_mfc_uses_dev() for unres entriesLinux
- CVE-2025-21718net: rose: fix timer races against user threadsLinux
- CVE-2025-21717net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sqLinux
- CVE-2025-21715net: davicom: fix UAF in dm9000_drv_removeLinux
- CVE-2025-21714RDMA/mlx5: Fix implicit ODP use after freeLinux
- CVE-2025-21712md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetimeLinux
- CVE-2025-21710tcp: correct handling of extreme memory squeezeLinux
- CVE-2025-21709kernel: be more careful about dup_mmap() failures and uprobe registeringLinux
- CVE-2024-57999powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDWLinux
- CVE-2024-57998OPP: add index check to assert to avoid buffer overflow in _read_freq()Linux
- CVE-2024-57997wifi: wcn36xx: fix channel survey memory allocation sizeLinux
- CVE-2024-57996net_sched: sch_sfq: don't allow 1 packet limitLinux
- CVE-2024-57995wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev()Linux
- CVE-2024-57990wifi: mt76: mt7925: fix off by one in mt7925_load_clc()Linux
- CVE-2024-57986HID: core: Fix assumption that Resolution Multipliers must be in Logical CollectionsLinux
- CVE-2024-57985firmware: qcom: scm: Cleanup global '__scm' on probe failuresLinux
- CVE-2024-57984i3c: dw: Fix use-after-free in dw_i3c_master driver due to race conditionLinux
- CVE-2024-57983mailbox: th1520: Fix memory corruption due to incorrect array sizeLinux
- CVE-2024-57982xfrm: state: fix out-of-bounds read during lookupLinux
- CVE-2024-57979pps: Fix a use-after-freeLinux
- CVE-2024-57976btrfs: do proper folio cleanup when cow_file_range() failedLinux
- CVE-2024-57975btrfs: do proper folio cleanup when run_delalloc_nocow() failedLinux
- CVE-2024-57973rdma/cxgb4: Prevent potential integer overflow on 32bitLinux
- CVE-2024-38291In XIQ-SE before 24.2.11, a low-privileged user may be able to access admin passwords, which could lead to privilege escalation.
- CVE-2024-41334Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior
- CVE-2024-41335Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior
- CVE-2024-41336Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior
- CVE-2024-41338A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to
- CVE-2024-41339An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.
- CVE-2024-41340An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862
- CVE-2025-25333An issue in IKEA CN iOS 4.13.0 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2025-25477A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be
- CVE-2025-25729An information disclosure vulnerability in Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 allows
- CVE-2025-25759An issue in the component admin_template.php of SUCMS v1.0 allows attackers to execute a directory traversal and arbitrary file deletion via
- CVE-2025-25760A Server-Side Request Forgery (SSRF) in the component admin_webgather.php of SUCMS v1.0 allows attackers to access internal data and service
- CVE-2025-25761HkCms v2.3.2.240702 was discovered to contain an arbitrary file write vulnerability in the component Appcenter.php.
- CVE-2025-26264GeoVision GV-ASWeb with the version 6.1.2.0 or less (fixed in 6.2.0), contains a Remote Code Execution (RCE) vulnerability within its Notifi
Medium, low and unrated 144
- CVE-2025-1681Cardealer <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Change and Delete JS and CSS FilesThemeMakers Car Dealer Automotive WordPress Theme – Respons…
- CVE-2025-24832Arbitrary file overwrite during home directory recovery due to improper symbolic link handling.Acronis Backup plugin for cPanel & WHM · Acronis Backup ext…
- CVE-2025-21824gpu: host1x: Fix a use of uninitialized mutexLinux
- CVE-2025-21822ptp: vmclock: Set driver data before its usageLinux
- CVE-2025-21821fbdev: omap: use threaded IRQ for LCD DMALinux
- CVE-2025-21820tty: xilinx_uartps: split sysrq handlingLinux
- CVE-2025-21819Revert "drm/amd/display: Use HW lock mgr for PSR1"Linux
- CVE-2025-21817block: mark GFP_NOIO around sysfs ->store()Linux
- CVE-2025-21816hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYINGLinux
- CVE-2025-21815mm/compaction: fix UBSAN shift-out-of-bounds warningLinux
- CVE-2025-21814ptp: Ensure info->enable callback is always setLinux
- CVE-2025-21813timers/migration: Fix off-by-one root mis-connectionLinux
- CVE-2025-21807block: fix queue freeze vs limits lock order in sysfs store methodsLinux
- CVE-2025-21806net: let net.core.dev_weight always be non-zeroLinux
- CVE-2025-21803LoongArch: Fix warnings during S3 suspendLinux
- CVE-2025-21802net: hns3: fix oops when unload drivers parallelingLinux
- CVE-2025-21800net/mlx5: HWS, fix definer's HWS_SET32 macro for negative offsetLinux
- CVE-2025-21799net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns()Linux
- CVE-2025-21798firewire: test: Fix potential null dereference in firewire kunit testLinux
- CVE-2024-58042rhashtable: Fix potential deadlock by moving schedule_work outside lockLinux
- CVE-2024-58022mailbox: th1520: Fix a NULL vs IS_ERR() bugLinux
- CVE-2025-22624FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry and Carousel 2.4.29 - Reflected cross-site scripting (XSS)bradvin FooGallery - Responsive Photo Gallery, Image Viewer…
- CVE-2025-0767WP Activity Log 5.3.2 - Insecure deserializationMelapress WP Activity Log
- CVE-2025-1745LinZhaoguan pb-cms Logout cross-site request forgeryLinZhaoguan pb-cms
- CVE-2025-1743zyx0814 Pichome index.php path traversalzyx0814 Pichome
- CVE-2025-27399Mastodon's domain blocks & rationales ignore user approval when visibility set as "users"mastodon
- CVE-2025-27157Mastodon's rate-limits are missing on `/auth/setup`mastodon
- CVE-2025-1742pihome-shc PiHome home.php cross site scriptingpihome-shc PiHome
- CVE-2024-9285Tu Yafeng Via Browser Javascript Bridge cross site scriptingTu Yafeng Via Browser
- CVE-2025-0914Velociraptor Shell Plugin Prevent_execve BypassRapid7 Velociraptor
- CVE-2025-1741b1gMail Admin Page users.php deserializationb1gMail
- CVE-2024-54170IBM EntireX denial of serviceIBM EntireX
- CVE-2024-54169IBM EntireX path traversalIBM EntireX
- CVE-2025-0759IBM EntireX race conditionIBM EntireX
- CVE-2024-56810IBM EntireX information disclosureIBM EntireX
- CVE-2024-56496IBM EntireX information disclosureIBM EntireX
- CVE-2024-56495IBM EntireX information disclosureIBM EntireX
- CVE-2024-56811IBM EntireX information disclosureIBM EntireX
- CVE-2024-56493IBM EntireX information disclosureIBM EntireX
- CVE-2024-56494IBM EntireX information disclosureIBM EntireX
- CVE-2024-56812IBM EntireX information disclosureIBM EntireX
- CVE-2024-13402BuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title'Boss Media BuddyBoss Platform
- CVE-2025-1693MongoDB Shell may be susceptible to control character Injection via shell outputMongoDB mongosh · mongosh
- CVE-2025-1692MongoDB Shell may be susceptible to control character injection via pastingMongoDB mongosh · mongosh
- CVE-2025-1738Multiple vulnerabilities in Trivision Camera NC227WFTrivision Camera NC227WF
- CVE-2024-10918Stack-based Buffer Overflow in libmodbus librarylibmodbus
- CVE-2024-13217Jeg Elementor Kit <= 2.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via Countdown and Off-Canvasjegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…
- CVE-2025-1450Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp – Chaty <= 3.3.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scriptingpremio Floating Chat Widget: Contact Chat Icons, Telegram C…
- CVE-2024-13734Card Elements for Elementor <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Profile Card Widgettecheshta Card Elements for Elementor
- CVE-2025-1690ThemeMakers Stripe Checkout <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeThemeMakers Stripe Checkout
- CVE-2024-5848Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products Due to Improper Input ValidationWSO2 API Manager · WSO2 Open Banking AM
- CVE-2024-0392Cross-Site Request Forgery (CSRF) in WSO2 Enterprise Integrator 6.6.0 Management Console Due to Missing CSRF Token ValidationWSO2 Enterprise Integrator
- CVE-2025-1689ThemeMakers PayPal Express Checkout <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeThemeMakers PayPal Express Checkout
- CVE-2024-13907Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.8 - Authenticated (Administrator+) Server-Side Request ForgeryTotal Upkeep – WordPress Backup Plugin plus Restore & Migra…
- CVE-2024-6261Image Photo Gallery Final Tiles Grid <= 3.6.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scriptingwpchill Image Photo Gallery Final Tiles Grid
- CVE-2025-1686Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the inio.pebbletemplates:pebble
- CVE-2024-13905OneStore Sites <= 0.1.1 - Unauthenticated Blind Server-Side Request Forgerysainwp OneStore Sites
- CVE-2024-13647School Management System – SakolaWP <= 1.0.8 - Cross-Site Request Forgery to Exam Setting Manipulationthemesawesome School Management System – SakolaWP
- CVE-2025-0469Forminator <= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2024-2321Incorrect Authorization in Multiple WSO2 Products Allows API Access via Refresh TokenWSO2 API Manager · WSO2 Identity Server +2
- CVE-2025-21793spi: sn-f-ospi: Fix division by zeroLinux
- CVE-2025-21790vxlan: check vxlan_vnigroup_init() return valueLinux
- CVE-2025-21787team: better TEAM_OPTION_TYPE_STRING validationLinux
- CVE-2025-21784drm/amdgpu: bail out when failed to load fw in psp_init_cap_microcode()Linux
- CVE-2025-21783gpiolib: Fix crash on error in gpiochip_get_ngpios()Linux
- CVE-2025-21782orangefs: fix a oob in orangefs_debug_writeLinux
- CVE-2025-21781batman-adv: fix panic during interface removalLinux
- CVE-2025-21779KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernelLinux
- CVE-2025-21777ring-buffer: Validate the persistent meta data subbuf arrayLinux
- CVE-2025-21776USB: hub: Ignore non-compliant devices with too many configs or interfacesLinux
- CVE-2025-21775can: ctucanfd: handle skb allocation failureLinux
- CVE-2025-21774can: rockchip: rkcanfd_handle_rx_fifo_overflow_int(): bail out if skb cannot be allocatedLinux
- CVE-2025-21773can: etas_es58x: fix potential NULL pointer dereference on udev->serialLinux
- CVE-2025-21771sched_ext: Fix incorrect autogroup migration detectionLinux
- CVE-2025-21770iommu: Fix potential memory leak in iopf_queue_remove_device()Linux
- CVE-2025-21769ptp: vmclock: Add .owner to vmclock_miscdev_fopsLinux
- CVE-2025-21768net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnelsLinux
- CVE-2025-21767clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic contextLinux
- CVE-2024-58021HID: winwing: Add NULL check in winwing_init_led()Linux
- CVE-2024-58020HID: multitouch: Add NULL check in mt_input_configuredLinux
- CVE-2024-57852firmware: qcom: scm: smc: Handle missing SCM deviceLinux
- CVE-2024-57834media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_threadLinux
- CVE-2024-52557drm: zynqmp_dp: Fix integer overflow in zynqmp_dp_rate_get()Linux
- CVE-2025-21754btrfs: fix assertion failure when splitting ordered extent after transaction abortLinux
- CVE-2025-21752btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extentsLinux
- CVE-2025-21750wifi: brcmfmac: Check the return value of of_property_read_string_index()Linux
- CVE-2025-21749net: rose: lock the socket in rose_bind()Linux
- CVE-2025-21747drm/ast: astdp: Fix timeout for enabling video signalLinux
- CVE-2025-21746Input: synaptics - fix crash when enabling pass-through portLinux
- CVE-2025-21745blk-cgroup: Fix class @block_class's subsystem refcount leakageLinux
- CVE-2025-21744wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()Linux
- CVE-2025-21737ceph: fix memory leak in ceph_mds_auth_match()Linux
- CVE-2025-21736nilfs2: fix possible int overflows in nilfs_fiemap()Linux
- CVE-2025-21733tracing/osnoise: Fix resetting of tracepointsLinux
- CVE-2025-21732RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with errorLinux
- CVE-2024-58018nvkm: correctly calculate the available space of the GSP cmdq bufferLinux
- CVE-2024-58017printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAXLinux
- CVE-2024-58016safesetid: check size of policy writesLinux
- CVE-2024-58015wifi: ath12k: Fix for out-of bound access errorLinux
- CVE-2024-58014wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()Linux
- CVE-2024-58012ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during paramsLinux
- CVE-2024-58011platform/x86: int3472: Check for adev == NULLLinux
- CVE-2024-58009Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_allocLinux
- CVE-2024-58007soc: qcom: socinfo: Avoid out of bounds read of serial numberLinux
- CVE-2024-58005tpm: Change to kvalloc() in eventlog/acpi.cLinux
- CVE-2024-58001ocfs2: handle a symlink read error correctlyLinux
- CVE-2025-21728bpf: Send signals asynchronously if !preemptibleLinux
- CVE-2025-21724iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()Linux
- CVE-2025-21723scsi: mpi3mr: Fix possible crash when setting up bsg failsLinux
- CVE-2025-21721nilfs2: handle errors that nilfs_prepare_chunk() may returnLinux
- CVE-2025-21716vxlan: Fix uninit-value in vxlan_vnifilter_dump()Linux
- CVE-2025-21713powerpc/pseries/iommu: Don't unset window if it was never setLinux
- CVE-2025-21711net/rose: prevent integer overflows in rose_setsockopt()Linux
- CVE-2025-21708net: usb: rtl8150: enable basic endpoint checkingLinux
- CVE-2025-21706mptcp: pm: only set fullmesh for subflow endpLinux
- CVE-2025-21705mptcp: handle fastopen disconnect correctlyLinux
- CVE-2024-58000io_uring: prevent reg-wait speculationsLinux
- CVE-2024-57994ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()Linux
- CVE-2024-57993HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint checkLinux
- CVE-2024-57992wifi: wilc1000: unregister wiphy only if it has been registeredLinux
- CVE-2024-57991wifi: rtw89: chan: fix soft lockup in rtw89_entity_recalc_mgnt_roles()Linux
- CVE-2024-57989wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_linksLinux
- CVE-2024-57988Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name()Linux
- CVE-2024-57987Bluetooth: btrtl: check for NULL in btrtl_setup_realtek()Linux
- CVE-2024-57981usb: xhci: Fix NULL pointer dereference on certain command abortsLinux
- CVE-2024-57980media: uvcvideo: Fix double free in error pathLinux
- CVE-2024-57978media: imx-jpeg: Fix potential error pointer dereference in detach_pm()Linux
- CVE-2024-57977memcg: fix soft lockup in the OOM processLinux
- CVE-2024-57974udp: Deal with race between UDP socket address change and rehashLinux
- CVE-2024-57953rtc: tps6594: Fix integer overflow on 32bit systemsLinux
- CVE-2024-38290In XIQ-SE before 24.2.11, a server misconfiguration may allow user enumeration when specific conditions are met.
- CVE-2024-53408AVE System Web Client v2.1.131.13992 was discovered to contain a cross-site scripting (XSS) vulnerability.
- CVE-2024-54957Nagios XI 2024R1.2.2 is vulnerable to an open redirect flaw on the Tools page, exploitable by users with read-only permissions.
- CVE-2025-25323An issue in Qianjin Network Information Technology (Shanghai) Co., Ltd 51Job iOS 14.22.0 allows attackers to access sensitive user informati
- CVE-2025-25324An issue in Shandong Provincial Big Data Center AiShanDong iOS 5.0.0 allows attackers to access sensitive user information via supplying a c
- CVE-2025-25325An issue in Yibin Fengguan Network Technology Co., Ltd YuPao DirectHire iOS 8.8.0 allows attackers to access sensitive user information via
- CVE-2025-25326An issue in Merchants Union Consumer Finance Company Limited Merchants Union Finance iOS 6.19.0 allows attackers to access sensitive user in
- CVE-2025-25329An issue in Tencent Technology (Beijing) Company Limited Tencent MicroVision iOS 8.137.0 allows attackers to access sensitive user informati
- CVE-2025-25330An issue in Boohee Technology Boohee Health iOS 13.0.13 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2025-25331An issue in Beitatong Technology LianJia iOS 9.83.50 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2025-25334An issue in Suning Commerce Group Suning EMall iOS 9.5.198 allows attackers to access sensitive user information via supplying a crafted lin
- CVE-2025-25727Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to store passwords in cleartext.
- CVE-2025-25728Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to send communications to the upd
- CVE-2025-25730An issue in Motorola Mobility Droid Razr HD (Model XT926) System Version: 9.18.94.XT926.Verizon.en.US allows physically proximate unauthoriz