# CVEs published 2025-09-15

407 CVEs were published on September 15, 2025: 18 critical, 99 high. Days are UTC.

- [CVE-2025-43332](https://cve.now/CVE-2025-43332.md): A file quarantine bypass was addressed with additional checks. (CVSS 5.2, Apple macOS)
- [CVE-2025-43298](https://cve.now/CVE-2025-43298.md): A parsing issue in the handling of directory paths was addressed with improved path validation. (CVSS 7.8, Apple macOS)
- [CVE-2025-43349](https://cve.now/CVE-2025-43349.md): An out-of-bounds write issue was addressed with improved input validation. (CVSS 2.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-43308](https://cve.now/CVE-2025-43308.md): This issue was addressed with additional entitlement checks. (CVSS 3.3, Apple macOS)
- [CVE-2025-43328](https://cve.now/CVE-2025-43328.md): A permissions issue was addressed with additional restrictions. (CVSS 3.3, Apple macOS)
- [CVE-2025-43294](https://cve.now/CVE-2025-43294.md): An issue existed in the handling of environment variables. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-43369](https://cve.now/CVE-2025-43369.md): This issue was addressed with improved handling of symlinks. (CVSS 5.5, Apple macOS)
- [CVE-2025-43312](https://cve.now/CVE-2025-43312.md): A buffer overflow was addressed with improved bounds checking. (CVSS 5.5, Apple macOS)
- [CVE-2025-43353](https://cve.now/CVE-2025-43353.md): The issue was addressed with improved bounds checks. (CVSS 5.5, Apple macOS)
- [CVE-2025-43304](https://cve.now/CVE-2025-43304.md): A race condition was addressed with improved state handling. (CVSS 7.0, Apple macOS)
- [CVE-2025-43305](https://cve.now/CVE-2025-43305.md): A logic issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2025-43344](https://cve.now/CVE-2025-43344.md): An out-of-bounds access issue was addressed with improved bounds checking. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-43190](https://cve.now/CVE-2025-43190.md): A parsing issue in the handling of directory paths was addressed with improved path validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-43368](https://cve.now/CVE-2025-43368.md): A use-after-free issue was addressed with improved memory management. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +1)
- [CVE-2025-43295](https://cve.now/CVE-2025-43295.md): A denial-of-service issue was addressed with improved validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2025-43329](https://cve.now/CVE-2025-43329.md): A permissions issue was addressed with additional restrictions. (CVSS 8.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-43283](https://cve.now/CVE-2025-43283.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 3.3, Apple macOS)
- [CVE-2025-43333](https://cve.now/CVE-2025-43333.md): A permissions issue was addressed with additional restrictions. (CVSS 7.8, Apple macOS)
- [CVE-2025-43299](https://cve.now/CVE-2025-43299.md): A denial-of-service issue was addressed with improved validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2025-43325](https://cve.now/CVE-2025-43325.md): An access issue was addressed with additional sandbox restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2025-43372](https://cve.now/CVE-2025-43372.md): The issue was addressed with improved input validation. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-43292](https://cve.now/CVE-2025-43292.md): A race condition was addressed with improved state handling. (CVSS 5.5, Apple macOS)
- [CVE-2025-43314](https://cve.now/CVE-2025-43314.md): A parsing issue in the handling of directory paths was addressed with improved path validation. (CVSS 5.5, Apple macOS)
- [CVE-2025-43343](https://cve.now/CVE-2025-43343.md): The issue was addressed with improved memory handling. (CVSS 9.8, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2025-43355](https://cve.now/CVE-2025-43355.md): A type confusion issue was addressed with improved memory handling. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-43302](https://cve.now/CVE-2025-43302.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-43375](https://cve.now/CVE-2025-43375.md): The issue was addressed with improved checks. (CVSS 7.5, Apple Xcode)
- [CVE-2025-31271](https://cve.now/CVE-2025-31271.md): This issue was addressed through improved state management. (CVSS 7.5, Apple macOS)
- [CVE-2025-43318](https://cve.now/CVE-2025-43318.md): This issue was addressed with additional entitlement checks. (CVSS 6.2, Apple macOS)
- [CVE-2025-43359](https://cve.now/CVE-2025-43359.md): A logic issue was addressed with improved state management. (CVSS 9.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-43358](https://cve.now/CVE-2025-43358.md): A permissions issue was addressed with additional sandbox restrictions. (CVSS 8.8, Apple iOS and iPadOS · Apple macOS)
- [CVE-2025-43319](https://cve.now/CVE-2025-43319.md): This issue was addressed by removing the vulnerable code. (CVSS 5.5, Apple macOS)
- [CVE-2025-43362](https://cve.now/CVE-2025-43362.md): The issue was addressed with improved checks. (CVSS 9.8, Apple iOS and iPadOS)
- [CVE-2025-31270](https://cve.now/CVE-2025-31270.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2025-43231](https://cve.now/CVE-2025-43231.md): A logic issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2025-43303](https://cve.now/CVE-2025-43303.md): A logging issue was addressed with improved data redaction. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-43354](https://cve.now/CVE-2025-43354.md): A logging issue was addressed with improved data redaction. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-43342](https://cve.now/CVE-2025-43342.md): A correctness issue was addressed with improved checks. (CVSS 9.8, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2025-43207](https://cve.now/CVE-2025-43207.md): This issue was addressed with improved entitlements. (CVSS 5.5, Apple macOS)
- [CVE-2025-43315](https://cve.now/CVE-2025-43315.md): This issue was addressed by removing the vulnerable code. (CVSS 5.5, Apple macOS)
- [CVE-2025-43293](https://cve.now/CVE-2025-43293.md): The issue was addressed with improved input validation. (CVSS 5.5, Apple macOS)
- [CVE-2025-43285](https://cve.now/CVE-2025-43285.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2025-43357](https://cve.now/CVE-2025-43357.md): This issue was addressed with improved redaction of sensitive information. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2025-43204](https://cve.now/CVE-2025-43204.md): This issue was addressed by removing the vulnerable code. (CVSS 7.8, Apple macOS)
- [CVE-2025-43341](https://cve.now/CVE-2025-43341.md): A permissions issue was addressed with additional restrictions. (CVSS 7.8, Apple macOS)
- [CVE-2025-43316](https://cve.now/CVE-2025-43316.md): A permissions issue was addressed with additional restrictions. (CVSS 7.8, Apple macOS · Apple visionOS)
- [CVE-2025-31269](https://cve.now/CVE-2025-31269.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2025-43286](https://cve.now/CVE-2025-43286.md): A permissions issue was addressed with additional restrictions. (CVSS 7.8, Apple macOS)
- [CVE-2025-43208](https://cve.now/CVE-2025-43208.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2025-24088](https://cve.now/CVE-2025-24088.md): The issue was addressed by adding additional logic. (CVSS 7.5, Apple macOS)
- [CVE-2025-43321](https://cve.now/CVE-2025-43321.md): The issue was resolved by blocking unsigned services from launching on Intel Macs. (CVSS 5.5, Apple macOS)
- [CVE-2025-43337](https://cve.now/CVE-2025-43337.md): An access issue was addressed with additional sandbox restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2025-43272](https://cve.now/CVE-2025-43272.md): The issue was addressed with improved memory handling. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +3)
- [CVE-2025-43287](https://cve.now/CVE-2025-43287.md): The issue was addressed with improved memory handling. (CVSS 7.1, Apple macOS)
- [CVE-2025-31268](https://cve.now/CVE-2025-31268.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2025-43291](https://cve.now/CVE-2025-43291.md): A permissions issue was addressed by removing the vulnerable code. (CVSS 5.5, Apple macOS)
- [CVE-2025-24197](https://cve.now/CVE-2025-24197.md): A logic issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2025-43317](https://cve.now/CVE-2025-43317.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-43340](https://cve.now/CVE-2025-43340.md): A permissions issue was addressed with additional restrictions. (CVSS 7.8, Apple macOS)
- [CVE-2025-43356](https://cve.now/CVE-2025-43356.md): The issue was addressed with improved handling of caches. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2025-43301](https://cve.now/CVE-2025-43301.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 3.3, Apple macOS)
- [CVE-2025-43367](https://cve.now/CVE-2025-43367.md): A privacy issue was addressed by moving sensitive data. (CVSS 5.5, Apple macOS)
- [CVE-2025-43330](https://cve.now/CVE-2025-43330.md): This issue was addressed by removing the vulnerable code. (CVSS 8.2, Apple macOS)
- [CVE-2025-43326](https://cve.now/CVE-2025-43326.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 5.5, Apple macOS)
- [CVE-2025-43263](https://cve.now/CVE-2025-43263.md): The issue was addressed with improved checks. (CVSS 7.1, Apple Xcode)
- [CVE-2025-43371](https://cve.now/CVE-2025-43371.md): This issue was addressed with improved checks. (CVSS 8.2, Apple Xcode)
- [CVE-2025-31255](https://cve.now/CVE-2025-31255.md): An authorization issue was addressed with improved state management. (CVSS 9.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-43347](https://cve.now/CVE-2025-43347.md): This issue was addressed by removing the vulnerable code. (CVSS 9.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-43310](https://cve.now/CVE-2025-43310.md): A configuration issue was addressed with additional restrictions. (CVSS 4.4, Apple macOS)
- [CVE-2025-43279](https://cve.now/CVE-2025-43279.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 6.2, Apple macOS)
- [CVE-2025-30468](https://cve.now/CVE-2025-30468.md): This issue was addressed through improved state management. (CVSS 6.5, Apple iOS and iPadOS)
- [CVE-2025-43297](https://cve.now/CVE-2025-43297.md): A type confusion issue was addressed with improved memory handling. (CVSS 6.2, Apple macOS)
- [CVE-2025-43311](https://cve.now/CVE-2025-43311.md): This issue was addressed with additional entitlement checks. (CVSS 5.1, Apple macOS)
- [CVE-2025-43203](https://cve.now/CVE-2025-43203.md): The issue was addressed with improved handling of caches. (CVSS 4.0, Apple iOS and iPadOS)
- [CVE-2025-43346](https://cve.now/CVE-2025-43346.md): An out-of-bounds access issue was addressed with improved bounds checking. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-31254](https://cve.now/CVE-2025-31254.md): This issue was addressed with improved URL validation. (CVSS 5.4, Apple Safari · Apple iOS and iPadOS)
- [CVE-2025-43307](https://cve.now/CVE-2025-43307.md): This issue was addressed with improved checks to prevent unauthorized actions. (CVSS 4.0, Apple macOS)
- [CVE-2025-43370](https://cve.now/CVE-2025-43370.md): A path handling issue was addressed with improved validation. (CVSS 4.0, Apple Xcode)
- [CVE-2025-43327](https://cve.now/CVE-2025-43327.md): The issue was addressed by adding additional logic. (CVSS 6.5, Apple Safari · Apple macOS)
- [CVE-2025-43262](https://cve.now/CVE-2025-43262.md): A permissions issue was addressed with additional restrictions. (CVSS 5.1, Apple macOS)
- [CVE-2025-43331](https://cve.now/CVE-2025-43331.md): A downgrade issue was addressed with additional code-signing restrictions. (CVSS 4.0, Apple macOS)
- [CVE-2025-43366](https://cve.now/CVE-2025-43366.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 5.5, Apple macOS)
- [CVE-2025-10485](https://cve.now/CVE-2025-10485.md): pojoin h3blog HTTP Header login ppt\_log cross site scripting (CVSS 5.3, pojoin h3blog)
- [CVE-2025-10483](https://cve.now/CVE-2025-10483.md): SourceCodester Online Student File Management System save\_user.php sql injection (CVSS 5.3, SourceCodester Online Student File Management System)
- [CVE-2025-10482](https://cve.now/CVE-2025-10482.md): SourceCodester Online Student File Management System index.php sql injection (CVSS 6.9, SourceCodester Online Student File Management System)
- [CVE-2025-10481](https://cve.now/CVE-2025-10481.md): SourceCodester Online Student File Management System remove\_file.php sql injection (CVSS 5.3, SourceCodester Online Student File Management System)
- [CVE-2025-43802](https://cve.now/CVE-2025-43802.md): Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/\<object-name\> API endpoint in Liferay Portal 7.4.3.51 through 7.4. (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-10480](https://cve.now/CVE-2025-10480.md): SourceCodester Online Student File Management System save\_file.php unrestricted upload (CVSS 5.3, SourceCodester Online Student File Management System)
- [CVE-2025-43797](https://cve.now/CVE-2025-43797.md): In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through (CVSS 5.3, Liferay Portal · Liferay DXP +1)
- [CVE-2025-6947](https://cve.now/CVE-2025-6947.md): WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in SIP Proxy Configuration (CVSS 4.8, WatchGuard Fireware OS)
- [CVE-2025-6999](https://cve.now/CVE-2025-6999.md): WatchGuard Firebox Authentication Portal Request Smuggling Vulnerability (CVSS 6.9, WatchGuard Fireware OS)
- [CVE-2025-59056](https://cve.now/CVE-2025-59056.md): FreePBX vulnerable to unauthenticated Denial of Service (CVSS 6.6, FreePBX framework)
- [CVE-2025-10479](https://cve.now/CVE-2025-10479.md): SourceCodester Online Student File Management System index.php sql injection (CVSS 6.9, SourceCodester Online Student File Management System)
- [CVE-2025-55211](https://cve.now/CVE-2025-55211.md): FreePBX Post-Authenticated Command Injection (CVSS 6.3, FreePBX framework)
- [CVE-2025-43798](https://cve.now/CVE-2025-43798.md): Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time passw (CVSS 2.1, Liferay DXP · com.liferay:com.liferay.multi.factor.authenti…)
- [CVE-2025-59145](https://cve.now/CVE-2025-59145.md): color-name@2.0.1 contains malware after npm account takeover (CVSS 8.8, colorjs color-name · color-name)
- [CVE-2025-10477](https://cve.now/CVE-2025-10477.md): kidaze CourseSelectionSystem eligibility.php sql injection (CVSS 5.3, kidaze CourseSelectionSystem)
- [CVE-2025-43799](https://cve.now/CVE-2025-43799.md): Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA throu (CVSS 6.9, Liferay Portal · Liferay DXP +1)
- [CVE-2025-59332](https://cve.now/CVE-2025-59332.md): 3DAlloy allows stored XSS through attributes provided to the 3d parser tag/function (CVSS 8.6, dolfinus 3DAlloy)
- [CVE-2025-59154](https://cve.now/CVE-2025-59154.md): Openfire allows potential identity spoofing via unsafe CN parsing (CVSS 5.9, igniterealtime Openfire · org.igniterealtime.openfire:xmpps…)
- [CVE-2025-10475](https://cve.now/CVE-2025-10475.md): SpyShelter IOCTL SpyShelter.sys denial of service (CVSS 6.8, SpyShelter)
- [CVE-2025-59331](https://cve.now/CVE-2025-59331.md): is-arrayish@0.3.3 contains malware after npm account takeover (CVSS 8.8, Qix- node-is-arrayish · is-arrayish)
- [CVE-2025-59330](https://cve.now/CVE-2025-59330.md): error-ex@1.3.3 contains malware after npm account takeover (CVSS 8.8, Qix- node-error-ex · error-ex)
- [CVE-2025-59162](https://cve.now/CVE-2025-59162.md): color-convert@3.1.1 contains malware after npm account takeover (CVSS 8.8, Qix- color-convert · color-convert)
- [CVE-2025-59142](https://cve.now/CVE-2025-59142.md): color-string@2.1.1 contains malware after npm account takeover (CVSS 8.8, Qix- color-string · color-string)
- [CVE-2025-59144](https://cve.now/CVE-2025-59144.md): debug@4.4.2 contains malware after npm account takeover (CVSS 8.8, debug-js debug · debug)
- [CVE-2025-59143](https://cve.now/CVE-2025-59143.md): color@5.0.1 contains malware after npm account takeover (CVSS 8.8, Qix- color · color)
- [CVE-2025-59141](https://cve.now/CVE-2025-59141.md): simple-swizzle@0.2.3 contains malware after npm account takeover (CVSS 8.8, Qix- node-simple-swizzle · simple-swizzle)
- [CVE-2025-59140](https://cve.now/CVE-2025-59140.md): backslash@0.2.1 contains malware after npm account takeover (CVSS 8.8, Qix- node-backslash · backslash)
- [CVE-2025-43800](https://cve.now/CVE-2025-43800.md): Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 throu (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-10473](https://cve.now/CVE-2025-10473.md): yangzongzhuan RuoYi Blacklist SqlUtil.java filterKeyword sql injection (CVSS 5.3, yangzongzhuan RuoYi)
- [CVE-2025-10472](https://cve.now/CVE-2025-10472.md): harry0703 MoneyPrinterTurbo URL video.py stream\_video path traversal (CVSS 6.9, harry0703 MoneyPrinterTurbo)
- [CVE-2025-43791](https://cve.now/CVE-2025-43791.md): Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-59155](https://cve.now/CVE-2025-59155.md): hackmd-mcp server-side request forgery in HTTP transport mode (CVSS 6.9, yuna0x0 hackmd-mcp · hackmd-mcp)
- [CVE-2025-58177](https://cve.now/CVE-2025-58177.md): n8n stored cross-site scripting in LangChain Chat Trigger node initialMessages parameter (CVSS 5.4, n8n-io n8n · n8n)
- [CVE-2025-58172](https://cve.now/CVE-2025-58172.md): drawnix debug logging cross-site scripting vulnerability (CVSS 5.3, plait-board drawnix)
- [CVE-2025-10471](https://cve.now/CVE-2025-10471.md): ZKEACMS MediaController.cs Proxy server-side request forgery (CVSS 5.3, ZKEACMS)
- [CVE-2025-10203](https://cve.now/CVE-2025-10203.md): Relative Path Traversal Vulnerability in Digilent WaveForms (CVSS 7.8, Digilent WaveForms)
- [CVE-2025-59328](https://cve.now/CVE-2025-59328.md): Apache Fory: Denial of Service (DoS) due to Deserialization of Untrusted malicious large Data (CVSS 6.5, Apache Software Foundation Apache Fory · org.apache.fory:fo…)
- [CVE-2025-43792](https://cve.now/CVE-2025-43792.md): Remote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023. (CVSS 2.3, Liferay Portal · Liferay DXP +1)
- [CVE-2025-58748](https://cve.now/CVE-2025-58748.md): Dataease H2 data source JDBC URL validation bypass leads to remote code execution (CVSS 8.7, dataease)
- [CVE-2025-10491](https://cve.now/CVE-2025-10491.md): MongoDB Windows installation MSI may leave ACLs unset on custom installation directories (CVSS 7.8, MongoDB Server)
- [CVE-2025-58046](https://cve.now/CVE-2025-58046.md): Dataease has a JDBC attack vulnerability in the Impala datasource (CVSS 8.7, dataease)
- [CVE-2025-58045](https://cve.now/CVE-2025-58045.md): Dataease server-side request forgery via unfiltered DB2 JDBC ldap parameter (CVSS 7.1, dataease)
- [CVE-2025-43793](https://cve.now/CVE-2025-43793.md): Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA throu (CVSS 6.9, Liferay Portal · Liferay DXP +2)
- [CVE-2025-36082](https://cve.now/CVE-2025-36082.md): IBM OpenPages information disclosure (CVSS 4.0, IBM OpenPages)
- [CVE-2025-6202](https://cve.now/CVE-2025-6202.md): Phoenix: Rowhammer attack on Hynix DDR5 devices (CVSS 7.1, SK Hynix DDR5)
- [CVE-2025-10459](https://cve.now/CVE-2025-10459.md): PHPGurukul Beauty Parlour Management System all-appointment.php sql injection (CVSS 6.9, PHPGurukul Beauty Parlour Management System)
- [CVE-2022-50337](https://cve.now/CVE-2022-50337.md): ocxl: fix pci device refcount leak when calling get\_function\_0() (no CVSS, Linux)
- [CVE-2022-50336](https://cve.now/CVE-2022-50336.md): fs/ntfs3: Add null pointer check to attr\_load\_runs\_vcn (no CVSS, Linux)
- [CVE-2022-50335](https://cve.now/CVE-2022-50335.md): 9p: set req refcount to zero to avoid uninitialized usage (CVSS 9.8, Linux)
- [CVE-2022-50334](https://cve.now/CVE-2022-50334.md): hugetlbfs: fix null-ptr-deref in hugetlbfs\_parse\_param() (no CVSS, Linux)
- [CVE-2022-50333](https://cve.now/CVE-2022-50333.md): fs: jfs: fix shift-out-of-bounds in dbDiscardAG (CVSS 7.8, Linux)
- [CVE-2022-50332](https://cve.now/CVE-2022-50332.md): video/aperture: Call sysfb\_disable() before removing PCI devices (no CVSS, Linux)
- [CVE-2022-50331](https://cve.now/CVE-2022-50331.md): wwan\_hwsim: fix possible memory leak in wwan\_hwsim\_dev\_new() (no CVSS, Linux)
- [CVE-2022-50330](https://cve.now/CVE-2022-50330.md): crypto: cavium - prevent integer overflow loading firmware (CVSS 7.1, Linux)
- [CVE-2022-50329](https://cve.now/CVE-2022-50329.md): block, bfq: fix uaf for bfqq in bfq\_exit\_icq\_bfqq (CVSS 7.8, Linux)
- [CVE-2022-50328](https://cve.now/CVE-2022-50328.md): jbd2: fix potential use-after-free in jbd2\_fc\_wait\_bufs (CVSS 7.8, Linux)
- [CVE-2022-50327](https://cve.now/CVE-2022-50327.md): ACPI: processor: idle: Check acpi\_fetch\_acpi\_dev() return value (no CVSS, Linux)
- [CVE-2022-50326](https://cve.now/CVE-2022-50326.md): media: airspy: fix memory leak in airspy probe (no CVSS, Linux)
- [CVE-2022-50325](https://cve.now/CVE-2022-50325.md): ASoC: Intel: avs: Fix potential RX buffer overflow (CVSS 7.8, Linux)
- [CVE-2022-50324](https://cve.now/CVE-2022-50324.md): mtd: maps: pxa2xx-flash: fix memory leak in probe (no CVSS, Linux)
- [CVE-2022-50323](https://cve.now/CVE-2022-50323.md): net: do not sense pfmemalloc status in skb\_append\_pagefrags() (no CVSS, Linux)
- [CVE-2022-50322](https://cve.now/CVE-2022-50322.md): rtc: msc313: Fix function prototype mismatch in msc313\_rtc\_probe() (no CVSS, Linux)
- [CVE-2022-50321](https://cve.now/CVE-2022-50321.md): wifi: brcmfmac: fix potential memory leak in brcmf\_netdev\_start\_xmit() (no CVSS, Linux)
- [CVE-2022-50320](https://cve.now/CVE-2022-50320.md): ACPI: tables: FPDT: Don't call acpi\_os\_map\_memory() on invalid phys address (no CVSS, Linux)
- [CVE-2022-50319](https://cve.now/CVE-2022-50319.md): coresight: trbe: remove cpuhp instance node before remove cpuhp state (no CVSS, Linux)
- [CVE-2022-50318](https://cve.now/CVE-2022-50318.md): perf/x86/intel/uncore: Fix reference count leak in hswep\_has\_limit\_sbox() (no CVSS, Linux)
- [CVE-2022-50317](https://cve.now/CVE-2022-50317.md): drm/bridge: megachips: Fix a null pointer dereference bug (no CVSS, Linux)
- [CVE-2022-50316](https://cve.now/CVE-2022-50316.md): orangefs: Fix kmemleak in orangefs\_sysfs\_init() (no CVSS, Linux)
- [CVE-2023-53262](https://cve.now/CVE-2023-53262.md): f2fs: fix scheduling while atomic in decompression path (CVSS 7.8, Linux)
- [CVE-2023-53261](https://cve.now/CVE-2023-53261.md): coresight: Fix memory leak in acpi\_buffer-\>pointer (CVSS 5.5, Linux)
- [CVE-2023-53260](https://cve.now/CVE-2023-53260.md): ovl: fix null pointer dereference in ovl\_permission() (CVSS 5.5, Linux)
- [CVE-2023-53259](https://cve.now/CVE-2023-53259.md): VMCI: check context-\>notify\_page after call to get\_user\_pages\_fast() to avoid GPF (no CVSS, Linux)
- [CVE-2023-53258](https://cve.now/CVE-2023-53258.md): drm/amd/display: Fix possible underflow for displays with large vblank (CVSS 5.5, Linux)
- [CVE-2023-53257](https://cve.now/CVE-2023-53257.md): wifi: mac80211: check S1G action frame size (CVSS 7.1, Linux)
- [CVE-2023-53256](https://cve.now/CVE-2023-53256.md): firmware: arm\_ffa: Fix FFA device names for logical partitions (CVSS 5.5, Linux)
- [CVE-2023-53255](https://cve.now/CVE-2023-53255.md): firmware: stratix10-svc: Fix a potential resource leak in svc\_create\_memory\_pool() (CVSS 5.5, Linux)
- [CVE-2023-53254](https://cve.now/CVE-2023-53254.md): cacheinfo: Fix shared\_cpu\_map to handle shared caches at different levels (CVSS 7.8, Linux)
- [CVE-2023-53253](https://cve.now/CVE-2023-53253.md): HID: nvidia-shield: Reference hid\_device devm allocation of input\_dev name (CVSS 8.8, Linux)
- [CVE-2023-53252](https://cve.now/CVE-2023-53252.md): Bluetooth: use RCU for hci\_conn\_params and iterate safely in hci\_sync (CVSS 7.8, Linux)
- [CVE-2023-53251](https://cve.now/CVE-2023-53251.md): wifi: iwlwifi: pcie: fix NULL pointer dereference in iwl\_pcie\_irq\_rx\_msix\_handler() (CVSS 5.5, Linux)
- [CVE-2023-53250](https://cve.now/CVE-2023-53250.md): firmware: dmi-sysfs: Fix null-ptr-deref in dmi\_sysfs\_register\_handle (CVSS 5.5, Linux)
- [CVE-2023-53249](https://cve.now/CVE-2023-53249.md): clk: imx: clk-imx8mn: fix memory leak in imx8mn\_clocks\_probe (CVSS 5.5, Linux)
- [CVE-2023-53248](https://cve.now/CVE-2023-53248.md): drm/amdgpu: install stub fence into potential unused fence pointers (CVSS 5.5, Linux)
- [CVE-2023-53247](https://cve.now/CVE-2023-53247.md): btrfs: set\_page\_extent\_mapped after read\_folio in btrfs\_cont\_expand (CVSS 5.5, Linux)
- [CVE-2023-53246](https://cve.now/CVE-2023-53246.md): cifs: fix DFS traversal oops without CONFIG\_CIFS\_DFS\_UPCALL (no CVSS, Linux)
- [CVE-2023-53245](https://cve.now/CVE-2023-53245.md): scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (CVSS 5.5, Linux)
- [CVE-2023-53244](https://cve.now/CVE-2023-53244.md): media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish (CVSS 5.5, Linux)
- [CVE-2023-53243](https://cve.now/CVE-2023-53243.md): btrfs: add handling for RAID1C23/DUP to btrfs\_reduce\_alloc\_profile (CVSS 5.5, Linux)
- [CVE-2022-50315](https://cve.now/CVE-2022-50315.md): ata: ahci: Match EM\_MAX\_SLOTS with SATA\_PMP\_MAX\_PORTS (CVSS 7.8, Linux)
- [CVE-2022-50314](https://cve.now/CVE-2022-50314.md): nbd: Fix hung when signal interrupts nbd\_start\_device\_ioctl() (no CVSS, Linux)
- [CVE-2022-50313](https://cve.now/CVE-2022-50313.md): erofs: fix order \>= MAX\_ORDER warning due to crafted negative i\_size (no CVSS, Linux)
- [CVE-2022-50312](https://cve.now/CVE-2022-50312.md): drivers: serial: jsm: fix some leaks in probe (no CVSS, Linux)
- [CVE-2022-50311](https://cve.now/CVE-2022-50311.md): cxl: Fix refcount leak in cxl\_calc\_capp\_routing (no CVSS, Linux)
- [CVE-2022-50310](https://cve.now/CVE-2022-50310.md): ip6mr: fix UAF issue in ip6mr\_sk\_done() when addrconf\_init\_net() failed (CVSS 7.8, Linux)
- [CVE-2022-50309](https://cve.now/CVE-2022-50309.md): media: xilinx: vipp: Fix refcount leak in xvip\_graph\_dma\_init (no CVSS, Linux)
- [CVE-2022-50308](https://cve.now/CVE-2022-50308.md): ASoC: qcom: Add checks for devm\_kcalloc (no CVSS, Linux)
- [CVE-2022-50307](https://cve.now/CVE-2022-50307.md): s390/cio: fix out-of-bounds access on cio\_ignore free (no CVSS, Linux)
- [CVE-2022-50306](https://cve.now/CVE-2022-50306.md): ext4: fix potential out of bound read in ext4\_fc\_replay\_scan() (CVSS 7.1, Linux)
- [CVE-2022-50305](https://cve.now/CVE-2022-50305.md): ASoC: sof\_es8336: fix possible use-after-free in sof\_es8336\_remove() (no CVSS, Linux)
- [CVE-2022-50304](https://cve.now/CVE-2022-50304.md): mtd: core: fix possible resource leak in init\_mtd() (no CVSS, Linux)
- [CVE-2022-50303](https://cve.now/CVE-2022-50303.md): drm/amdkfd: Fix double release compute pasid (CVSS 7.8, Linux)
- [CVE-2022-50302](https://cve.now/CVE-2022-50302.md): lockd: set other missing fields when unlocking files (CVSS 7.5, Linux)
- [CVE-2022-50301](https://cve.now/CVE-2022-50301.md): iommu/omap: Fix buffer overflow in debugfs (no CVSS, Linux)
- [CVE-2022-50300](https://cve.now/CVE-2022-50300.md): btrfs: fix extent map use-after-free when handling missing device in read\_one\_chunk (CVSS 7.8, Linux)
- [CVE-2022-50299](https://cve.now/CVE-2022-50299.md): md: Replace snprintf with scnprintf (no CVSS, Linux)
- [CVE-2022-50298](https://cve.now/CVE-2022-50298.md): slimbus: qcom-ngd: cleanup in probe error path (no CVSS, Linux)
- [CVE-2022-50297](https://cve.now/CVE-2022-50297.md): wifi: ath9k: verify the expected usb\_endpoints are present (no CVSS, Linux)
- [CVE-2022-50296](https://cve.now/CVE-2022-50296.md): UM: cpuinfo: Fix a warning for CONFIG\_CPUMASK\_OFFSTACK (no CVSS, Linux)
- [CVE-2022-50295](https://cve.now/CVE-2022-50295.md): io\_uring/msg\_ring: Fix NULL pointer dereference in io\_msg\_send\_fd() (no CVSS, Linux)
- [CVE-2022-50294](https://cve.now/CVE-2022-50294.md): wifi: libertas: fix memory leak in lbs\_init\_adapter() (no CVSS, Linux)
- [CVE-2022-50293](https://cve.now/CVE-2022-50293.md): btrfs: do not BUG\_ON() on ENOMEM when dropping extent items for a range (no CVSS, Linux)
- [CVE-2022-50292](https://cve.now/CVE-2022-50292.md): drm/msm/dp: fix bridge lifetime (no CVSS, Linux)
- [CVE-2022-50291](https://cve.now/CVE-2022-50291.md): kcm: annotate data-races around kcm-\>rx\_psock (no CVSS, Linux)
- [CVE-2023-53242](https://cve.now/CVE-2023-53242.md): thermal/drivers/hisi: Drop second sensor hi3660 (CVSS 7.1, Linux)
- [CVE-2023-53241](https://cve.now/CVE-2023-53241.md): nfsd: call op\_release, even when op\_func returns an error (CVSS 5.5, Linux)
- [CVE-2023-53240](https://cve.now/CVE-2023-53240.md): xsk: check IFF\_UP earlier in Tx path (CVSS 5.5, Linux)
- [CVE-2023-53239](https://cve.now/CVE-2023-53239.md): drm/msm/mdp5: Add check for kzalloc (CVSS 5.5, Linux)
- [CVE-2023-53238](https://cve.now/CVE-2023-53238.md): phy: hisilicon: Fix an out of bounds check in hisi\_inno\_phy\_probe() (CVSS 7.1, Linux)
- [CVE-2023-53237](https://cve.now/CVE-2023-53237.md): drm/amdgpu: fix amdgpu\_irq\_put call trace in gmc\_v11\_0\_hw\_fini (CVSS 5.5, Linux)
- [CVE-2023-53236](https://cve.now/CVE-2023-53236.md): iommufd: Do not corrupt the pfn list when doing batch carry (CVSS 7.8, Linux)
- [CVE-2023-53235](https://cve.now/CVE-2023-53235.md): drm/tests: helpers: Avoid a driver uaf (CVSS 7.8, Linux)
- [CVE-2023-53234](https://cve.now/CVE-2023-53234.md): watchdog: Fix kmemleak in watchdog\_cdev\_register (CVSS 5.5, Linux)
- [CVE-2023-53233](https://cve.now/CVE-2023-53233.md): net/smc: fix deadlock triggered by cancel\_delayed\_work\_syn() (CVSS 5.5, Linux)
- [CVE-2023-53232](https://cve.now/CVE-2023-53232.md): mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data (no CVSS, Linux)
- [CVE-2023-53231](https://cve.now/CVE-2023-53231.md): erofs: Fix detection of atomic context (CVSS 5.5, Linux)
- [CVE-2023-53230](https://cve.now/CVE-2023-53230.md): smb: client: fix warning in cifs\_smb3\_do\_mount() (CVSS 5.5, Linux)
- [CVE-2023-53229](https://cve.now/CVE-2023-53229.md): wifi: mac80211: fix invalid drv\_sta\_pre\_rcu\_remove calls for non-uploaded sta (CVSS 7.1, Linux)
- [CVE-2023-53228](https://cve.now/CVE-2023-53228.md): drm/amdgpu: drop redundant sched job cleanup when cs is aborted (CVSS 5.5, Linux)
- [CVE-2023-53226](https://cve.now/CVE-2023-53226.md): wifi: mwifiex: Fix OOB and integer underflow when rx packets (CVSS 8.8, Linux)
- [CVE-2023-53225](https://cve.now/CVE-2023-53225.md): spi: imx: Don't skip cleanup in remove's error path (CVSS 5.5, Linux)
- [CVE-2023-53224](https://cve.now/CVE-2023-53224.md): ext4: Fix function prototype mismatch for ext4\_feat\_ktype (CVSS 5.5, Linux)
- [CVE-2023-53223](https://cve.now/CVE-2023-53223.md): drm/msm/dsi: Add missing check for alloc\_ordered\_workqueue (CVSS 5.5, Linux)
- [CVE-2023-53222](https://cve.now/CVE-2023-53222.md): jfs: jfs\_dmap: Validate db\_l2nbperpage while mounting (CVSS 7.8, Linux)
- [CVE-2023-53221](https://cve.now/CVE-2023-53221.md): bpf: Fix memleak due to fentry attach failure (CVSS 5.5, Linux)
- [CVE-2023-53220](https://cve.now/CVE-2023-53220.md): media: az6007: Fix null-ptr-deref in az6007\_i2c\_xfer() (CVSS 5.5, Linux)
- [CVE-2023-53219](https://cve.now/CVE-2023-53219.md): media: netup\_unidvb: fix use-after-free at del\_timer() (CVSS 7.8, Linux)
- [CVE-2023-53218](https://cve.now/CVE-2023-53218.md): rxrpc: Make it so that a waiting process can be aborted (CVSS 7.8, Linux)
- [CVE-2023-53217](https://cve.now/CVE-2023-53217.md): nubus: Partially revert proc\_create\_single\_data() conversion (CVSS 7.8, Linux)
- [CVE-2023-53216](https://cve.now/CVE-2023-53216.md): arm64: efi: Make efi\_rt\_lock a raw\_spinlock (CVSS 7.8, Linux)
- [CVE-2023-53215](https://cve.now/CVE-2023-53215.md): sched/fair: Don't balance task to its current running CPU (CVSS 7.8, Linux)
- [CVE-2023-53214](https://cve.now/CVE-2023-53214.md): f2fs: fix to avoid potential memory corruption in \_\_update\_iostat\_latency() (CVSS 7.0, Linux)
- [CVE-2023-53213](https://cve.now/CVE-2023-53213.md): wifi: brcmfmac: slab-out-of-bounds read in brcmf\_get\_assoc\_ies() (CVSS 8.1, Linux)
- [CVE-2023-53211](https://cve.now/CVE-2023-53211.md): driver core: location: Free struct acpi\_pld\_info \*pld before return false (CVSS 5.5, Linux)
- [CVE-2023-53210](https://cve.now/CVE-2023-53210.md): md/raid5-cache: fix null-ptr-deref for r5l\_flush\_stripe\_to\_raid() (CVSS 5.5, Linux)
- [CVE-2023-53209](https://cve.now/CVE-2023-53209.md): wifi: mac80211\_hwsim: Fix possible NULL dereference (CVSS 5.5, Linux)
- [CVE-2023-53208](https://cve.now/CVE-2023-53208.md): KVM: nSVM: Load L1's TSC multiplier based on L1 state, not L2 state (CVSS 5.5, Linux)
- [CVE-2023-53207](https://cve.now/CVE-2023-53207.md): ublk: fail to recover device if queue setup is interrupted (CVSS 5.5, Linux)
- [CVE-2023-53206](https://cve.now/CVE-2023-53206.md): hwmon: (pmbus\_core) Fix NULL pointer dereference (no CVSS, Linux)
- [CVE-2023-53205](https://cve.now/CVE-2023-53205.md): KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler (CVSS 7.3, Linux)
- [CVE-2023-53204](https://cve.now/CVE-2023-53204.md): af\_unix: Fix data-races around user-\>unix\_inflight. (no CVSS, Linux)
- [CVE-2023-53203](https://cve.now/CVE-2023-53203.md): wifi: mt76: mt7996: rely on mt76\_connac2\_mac\_tx\_rate\_val (no CVSS, Linux)
- [CVE-2023-53202](https://cve.now/CVE-2023-53202.md): PM: domains: fix memory leak with using debugfs\_lookup() (no CVSS, Linux)
- [CVE-2023-53201](https://cve.now/CVE-2023-53201.md): RDMA/bnxt\_re: wraparound mbox producer index (no CVSS, Linux)
- [CVE-2023-53200](https://cve.now/CVE-2023-53200.md): netfilter: x\_tables: fix percpu counter block leak on error path when creating new netns (no CVSS, Linux)
- [CVE-2023-53199](https://cve.now/CVE-2023-53199.md): wifi: ath9k: hif\_usb: clean up skbs if ath9k\_hif\_usb\_rx\_stream() fails (no CVSS, Linux)
- [CVE-2022-50289](https://cve.now/CVE-2022-50289.md): ocfs2: fix memory leak in ocfs2\_stack\_glue\_init() (no CVSS, Linux)
- [CVE-2022-50288](https://cve.now/CVE-2022-50288.md): qlcnic: prevent -\>dcb use-after-free on qlcnic\_dcb\_enable() failure (no CVSS, Linux)
- [CVE-2022-50287](https://cve.now/CVE-2022-50287.md): drm/i915/bios: fix a memory leak in generate\_lfp\_data\_ptrs (no CVSS, Linux)
- [CVE-2022-50286](https://cve.now/CVE-2022-50286.md): ext4: fix delayed allocation bug in ext4\_clu\_mapped for bigalloc + inline (CVSS 7.8, Linux)
- [CVE-2022-50285](https://cve.now/CVE-2022-50285.md): mm,hugetlb: take hugetlb\_lock before decrementing h-\>resv\_huge\_pages (no CVSS, Linux)
- [CVE-2022-50284](https://cve.now/CVE-2022-50284.md): ipc: fix memory leak in init\_mqueue\_fs() (no CVSS, Linux)
- [CVE-2022-50283](https://cve.now/CVE-2022-50283.md): mtd: core: add missing of\_node\_get() in dynamic partitions code (CVSS 7.8, Linux)
- [CVE-2022-50282](https://cve.now/CVE-2022-50282.md): chardev: fix error handling in cdev\_device\_add() (no CVSS, Linux)
- [CVE-2022-50281](https://cve.now/CVE-2022-50281.md): MIPS: SGI-IP27: Fix platform-device leak in bridge\_platform\_create() (no CVSS, Linux)
- [CVE-2022-50280](https://cve.now/CVE-2022-50280.md): pnode: terminate at peers of source (no CVSS, Linux)
- [CVE-2022-50279](https://cve.now/CVE-2022-50279.md): wifi: rtlwifi: Fix global-out-of-bounds bug in \_rtl8812ae\_phy\_set\_txpower\_limit() (no CVSS, Linux)
- [CVE-2022-50278](https://cve.now/CVE-2022-50278.md): PNP: fix name memory leak in pnp\_alloc\_dev() (no CVSS, Linux)
- [CVE-2022-50277](https://cve.now/CVE-2022-50277.md): ext4: don't allow journal inode to have encrypt flag (no CVSS, Linux)
- [CVE-2022-50276](https://cve.now/CVE-2022-50276.md): power: supply: fix null pointer dereferencing in power\_supply\_get\_battery\_info (no CVSS, Linux)
- [CVE-2022-50275](https://cve.now/CVE-2022-50275.md): drm/radeon: Add the missed acpi\_put\_table() to fix memory leak (no CVSS, Linux)
- [CVE-2022-50274](https://cve.now/CVE-2022-50274.md): media: dvbdev: adopts refcnt to avoid UAF (CVSS 7.8, Linux)
- [CVE-2022-50273](https://cve.now/CVE-2022-50273.md): f2fs: fix to do sanity check on destination blkaddr during recovery (no CVSS, Linux)
- [CVE-2022-50272](https://cve.now/CVE-2022-50272.md): media: dvb-usb: az6027: fix null-ptr-deref in az6027\_i2c\_xfer() (no CVSS, Linux)
- [CVE-2022-50271](https://cve.now/CVE-2022-50271.md): vhost/vsock: Use kvmalloc/kvfree for larger packets. (no CVSS, Linux)
- [CVE-2022-50270](https://cve.now/CVE-2022-50270.md): f2fs: fix the assign logic of iocb (CVSS 7.1, Linux)
- [CVE-2022-50269](https://cve.now/CVE-2022-50269.md): drm/vkms: Fix memory leak in vkms\_init() (no CVSS, Linux)
- [CVE-2022-50268](https://cve.now/CVE-2022-50268.md): mmc: moxart: fix return value check of mmc\_add\_host() (no CVSS, Linux)
- [CVE-2022-50267](https://cve.now/CVE-2022-50267.md): mmc: rtsx\_pci: fix return value check of mmc\_add\_host() (no CVSS, Linux)
- [CVE-2022-50266](https://cve.now/CVE-2022-50266.md): kprobes: Fix check for probe enabled in kill\_kprobe() (no CVSS, Linux)
- [CVE-2022-50265](https://cve.now/CVE-2022-50265.md): kcm: annotate data-races around kcm-\>rx\_wait (no CVSS, Linux)
- [CVE-2022-50264](https://cve.now/CVE-2022-50264.md): clk: socfpga: Fix memory leak in socfpga\_gate\_init() (no CVSS, Linux)
- [CVE-2022-50263](https://cve.now/CVE-2022-50263.md): vdpasim: fix memory leak when freeing IOTLBs (no CVSS, Linux)
- [CVE-2022-50262](https://cve.now/CVE-2022-50262.md): fs/ntfs3: Validate BOOT record\_size (no CVSS, Linux)
- [CVE-2025-8396](https://cve.now/CVE-2025-8396.md): Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due (CVSS 6.9, Temporal OSS Server · go.temporal.io/server)
- [CVE-2023-53198](https://cve.now/CVE-2023-53198.md): raw: Fix NULL deref in raw\_get\_next(). (no CVSS, Linux)
- [CVE-2023-53197](https://cve.now/CVE-2023-53197.md): USB: uhci: fix memory leak with using debugfs\_lookup() (no CVSS, Linux)
- [CVE-2023-53196](https://cve.now/CVE-2023-53196.md): usb: dwc3: qcom: Fix potential memory leak (no CVSS, Linux)
- [CVE-2023-53195](https://cve.now/CVE-2023-53195.md): mlxsw: minimal: fix potential memory leak in mlxsw\_m\_linecards\_init (no CVSS, Linux)
- [CVE-2023-53194](https://cve.now/CVE-2023-53194.md): fs/ntfs3: Add length check in indx\_get\_root (CVSS 8.4, Linux)
- [CVE-2023-53193](https://cve.now/CVE-2023-53193.md): drm/amdgpu: fix amdgpu\_irq\_put call trace in gmc\_v10\_0\_hw\_fini (no CVSS, Linux)
- [CVE-2023-53192](https://cve.now/CVE-2023-53192.md): vxlan: Fix nexthop hash size (CVSS 9.8, Linux)
- [CVE-2023-53191](https://cve.now/CVE-2023-53191.md): irqchip/alpine-msi: Fix refcount leak in alpine\_msix\_init\_domains (no CVSS, Linux)
- [CVE-2023-53190](https://cve.now/CVE-2023-53190.md): vxlan: Fix memory leaks in error path (no CVSS, Linux)
- [CVE-2023-53189](https://cve.now/CVE-2023-53189.md): ipv6/addrconf: fix a potential refcount underflow for idev (CVSS 7.8, Linux)
- [CVE-2023-53188](https://cve.now/CVE-2023-53188.md): net: openvswitch: fix race on port output (no CVSS, Linux)
- [CVE-2023-53187](https://cve.now/CVE-2023-53187.md): btrfs: fix use-after-free of new block group that became unused (CVSS 7.8, Linux)
- [CVE-2023-53186](https://cve.now/CVE-2023-53186.md): skbuff: Fix a race between coalescing and releasing SKBs (CVSS 8.1, Linux)
- [CVE-2023-53185](https://cve.now/CVE-2023-53185.md): wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes (no CVSS, Linux)
- [CVE-2023-53184](https://cve.now/CVE-2023-53184.md): arm64/sme: Set new vector length before reallocating (CVSS 7.8, Linux)
- [CVE-2023-53182](https://cve.now/CVE-2023-53182.md): ACPICA: Avoid undefined behavior: applying zero offset to null pointer (no CVSS, Linux)
- [CVE-2023-53181](https://cve.now/CVE-2023-53181.md): dma-buf/dma-resv: Stop leaking on krealloc() failure (no CVSS, Linux)
- [CVE-2023-53180](https://cve.now/CVE-2023-53180.md): wifi: ath12k: Avoid NULL pointer access during management transmit cleanup (no CVSS, Linux)
- [CVE-2023-53179](https://cve.now/CVE-2023-53179.md): netfilter: ipset: add the missing IP\_SET\_HASH\_WITH\_NET0 macro for ip\_set\_hash\_netportnet.c (CVSS 7.8, Linux)
- [CVE-2023-53178](https://cve.now/CVE-2023-53178.md): mm: fix zswap writeback race condition (CVSS 7.8, Linux)
- [CVE-2023-53177](https://cve.now/CVE-2023-53177.md): media: hi846: fix usage of pm\_runtime\_get\_if\_in\_use() (no CVSS, Linux)
- [CVE-2023-53176](https://cve.now/CVE-2023-53176.md): serial: 8250: Reinit port-\>pm on port specific driver unbind (CVSS 7.8, Linux)
- [CVE-2023-53175](https://cve.now/CVE-2023-53175.md): PCI: hv: Fix a crash in hv\_pci\_restore\_msi\_msg() during hibernation (no CVSS, Linux)
- [CVE-2023-53174](https://cve.now/CVE-2023-53174.md): scsi: core: Fix possible memory leak if device\_add() fails (no CVSS, Linux)
- [CVE-2023-53173](https://cve.now/CVE-2023-53173.md): tty: pcn\_uart: fix memory leak with using debugfs\_lookup() (no CVSS, Linux)
- [CVE-2023-53172](https://cve.now/CVE-2023-53172.md): fsverity: reject FS\_IOC\_ENABLE\_VERITY on mode 3 fds (no CVSS, Linux)
- [CVE-2023-53171](https://cve.now/CVE-2023-53171.md): vfio/type1: prevent underflow of locked\_vm via exec() (no CVSS, Linux)
- [CVE-2023-53170](https://cve.now/CVE-2023-53170.md): net: dsa: Removed unneeded of\_node\_put in felix\_parse\_ports\_node (CVSS 7.8, Linux)
- [CVE-2023-53169](https://cve.now/CVE-2023-53169.md): x86/resctrl: Clear staged\_config\[\] before and after it is used (no CVSS, Linux)
- [CVE-2023-53168](https://cve.now/CVE-2023-53168.md): usb: ucsi\_acpi: Increase the command completion timeout (no CVSS, Linux)
- [CVE-2023-53167](https://cve.now/CVE-2023-53167.md): tracing: Fix null pointer dereference in tracing\_err\_log\_open() (no CVSS, Linux)
- [CVE-2023-53166](https://cve.now/CVE-2023-53166.md): power: supply: bq25890: Fix external\_power\_changed race (no CVSS, Linux)
- [CVE-2023-53165](https://cve.now/CVE-2023-53165.md): udf: Fix uninitialized array access for some pathnames (no CVSS, Linux)
- [CVE-2023-53164](https://cve.now/CVE-2023-53164.md): irqchip/ti-sci: Fix refcount leak in ti\_sci\_intr\_irq\_domain\_probe (no CVSS, Linux)
- [CVE-2023-53163](https://cve.now/CVE-2023-53163.md): fs/ntfs3: don't hold ni\_lock when calling truncate\_setsize() (no CVSS, Linux)
- [CVE-2023-53153](https://cve.now/CVE-2023-53153.md): wifi: cfg80211: Fix use after free for wext (no CVSS, Linux)
- [CVE-2023-53152](https://cve.now/CVE-2023-53152.md): drm/amdgpu: fix calltrace warning in amddrm\_buddy\_fini (no CVSS, Linux)
- [CVE-2023-53151](https://cve.now/CVE-2023-53151.md): md/raid10: prevent soft lockup while flush writes (no CVSS, Linux)
- [CVE-2023-53150](https://cve.now/CVE-2023-53150.md): scsi: qla2xxx: Pointer may be dereferenced (no CVSS, Linux)
- [CVE-2023-53149](https://cve.now/CVE-2023-53149.md): ext4: avoid deadlock in fs reclaim with page writeback (no CVSS, Linux)
- [CVE-2023-53148](https://cve.now/CVE-2023-53148.md): igb: Fix igb\_down hung on surprise removal (no CVSS, Linux)
- [CVE-2023-53147](https://cve.now/CVE-2023-53147.md): xfrm: add NULL check in xfrm\_update\_ae\_params (no CVSS, Linux)
- [CVE-2022-50261](https://cve.now/CVE-2022-50261.md): drm/sti: Fix return type of sti\_{dvo,hda,hdmi}\_connector\_mode\_valid() (no CVSS, Linux)
- [CVE-2022-50260](https://cve.now/CVE-2022-50260.md): drm/msm: Make .remove and .shutdown HW shutdown consistent (no CVSS, Linux)
- [CVE-2022-50259](https://cve.now/CVE-2022-50259.md): bpf, sockmap: fix race in sock\_map\_free() (CVSS 7.8, Linux)
- [CVE-2022-50258](https://cve.now/CVE-2022-50258.md): wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf\_c\_preinit\_dcmds() (no CVSS, Linux)
- [CVE-2022-50257](https://cve.now/CVE-2022-50257.md): xen/gntdev: Prevent leaking grants (no CVSS, Linux)
- [CVE-2022-50256](https://cve.now/CVE-2022-50256.md): drm/meson: remove drm bridges at aggregate driver unbind time (no CVSS, Linux)
- [CVE-2022-50255](https://cve.now/CVE-2022-50255.md): tracing: Fix reading strings from synthetic events (CVSS 7.8, Linux)
- [CVE-2022-50254](https://cve.now/CVE-2022-50254.md): media: ov8865: Fix an error handling path in ov8865\_probe() (no CVSS, Linux)
- [CVE-2022-50253](https://cve.now/CVE-2022-50253.md): bpf: make sure skb-\>len != 0 when redirecting to a tunneling device (no CVSS, Linux)
- [CVE-2022-50252](https://cve.now/CVE-2022-50252.md): igb: Do not free q\_vector unless new one was allocated (CVSS 7.8, Linux)
- [CVE-2022-50251](https://cve.now/CVE-2022-50251.md): mmc: vub300: fix return value check of mmc\_add\_host() (no CVSS, Linux)
- [CVE-2022-50250](https://cve.now/CVE-2022-50250.md): regulator: core: fix use\_count leakage when handling boot-on (no CVSS, Linux)
- [CVE-2022-50249](https://cve.now/CVE-2022-50249.md): memory: of: Fix refcount leak bug in of\_get\_ddr\_timings() (no CVSS, Linux)
- [CVE-2022-50248](https://cve.now/CVE-2022-50248.md): wifi: iwlwifi: mvm: fix double free on tx path. (CVSS 7.8, Linux)
- [CVE-2025-10448](https://cve.now/CVE-2025-10448.md): Campcodes Online Job Finder System index.php sql injection (CVSS 6.9, Campcodes Online Job Finder System)
- [CVE-2022-50247](https://cve.now/CVE-2022-50247.md): usb: xhci-mtk: fix leakage of shared hcd when fail to set wakeup irq (no CVSS, Linux)
- [CVE-2022-50246](https://cve.now/CVE-2022-50246.md): usb: typec: tcpci: fix of node refcount leak in tcpci\_register\_port() (no CVSS, Linux)
- [CVE-2022-50245](https://cve.now/CVE-2022-50245.md): rapidio: fix possible UAF when kfifo\_alloc() fails (no CVSS, Linux)
- [CVE-2022-50244](https://cve.now/CVE-2022-50244.md): cxl: fix possible null-ptr-deref in cxl\_pci\_init\_afu|adapter() (no CVSS, Linux)
- [CVE-2022-50243](https://cve.now/CVE-2022-50243.md): sctp: handle the error returned from sctp\_auth\_asoc\_init\_active\_key (CVSS 7.8, Linux)
- [CVE-2022-50242](https://cve.now/CVE-2022-50242.md): drivers: net: qlcnic: Fix potential memory leak in qlcnic\_sriov\_init() (no CVSS, Linux)
- [CVE-2022-50241](https://cve.now/CVE-2022-50241.md): NFSD: fix use-after-free on source server when doing inter-server copy (CVSS 8.8, Linux)
- [CVE-2022-50240](https://cve.now/CVE-2022-50240.md): android: binder: stop saving a pointer to the VMA (CVSS 7.8, Linux)
- [CVE-2022-50239](https://cve.now/CVE-2022-50239.md): cpufreq: qcom: fix writes in read-only memory region (no CVSS, Linux)
- [CVE-2022-50236](https://cve.now/CVE-2022-50236.md): iommu/mediatek: Fix crash on isr after kexec() (no CVSS, Linux)
- [CVE-2022-50235](https://cve.now/CVE-2022-50235.md): NFSD: Protect against send buffer overflow in NFSv2 READDIR (CVSS 9.8, Linux)
- [CVE-2022-50234](https://cve.now/CVE-2022-50234.md): io\_uring/af\_unix: defer registered files gc to io\_uring release (CVSS 7.8, Linux)
- [CVE-2025-10447](https://cve.now/CVE-2025-10447.md): Campcodes Online Job Finder System applicationform.php unrestricted upload (CVSS 6.9, Campcodes Online Job Finder System)
- [CVE-2025-10446](https://cve.now/CVE-2025-10446.md): Campcodes Computer Sales and Inventory System cust\_searchfrm.php sql injection (CVSS 6.9, Campcodes Computer Sales and Inventory System)
- [CVE-2025-39804](https://cve.now/CVE-2025-39804.md): lib/crypto: arm64/poly1305: Fix register corruption in no-SIMD contexts (CVSS 7.5, Linux)
- [CVE-2025-39803](https://cve.now/CVE-2025-39803.md): scsi: ufs: core: Remove WARN\_ON\_ONCE() call from ufshcd\_uic\_cmd\_compl() (no CVSS, Linux)
- [CVE-2025-39802](https://cve.now/CVE-2025-39802.md): lib/crypto: arm/poly1305: Fix register corruption in no-SIMD contexts (CVSS 7.5, Linux)
- [CVE-2025-39801](https://cve.now/CVE-2025-39801.md): usb: dwc3: Remove WARN\_ON for device endpoint command timeouts (no CVSS, Linux)
- [CVE-2025-39800](https://cve.now/CVE-2025-39800.md): btrfs: abort transaction on unexpected eb generation at btrfs\_copy\_root() (CVSS 7.8, Linux)
- [CVE-2025-10445](https://cve.now/CVE-2025-10445.md): Campcodes Computer Sales and Inventory System us\_transac.php sql injection (CVSS 6.9, Campcodes Computer Sales and Inventory System)
- [CVE-2025-3025](https://cve.now/CVE-2025-3025.md): CCleaner Link Following Local Privilege Escalation Vulnerability (CVSS 7.3, Gen Digital CCleaner)
- [CVE-2025-10444](https://cve.now/CVE-2025-10444.md): Campcodes Online Job Finder System advancesearch.php sql injection (CVSS 6.9, Campcodes Online Job Finder System)
- [CVE-2025-59361](https://cve.now/CVE-2025-59361.md): OS command injection in Chaos Mesh via the cleanIptables mutation (CVSS 9.8, github.com/chaos-mesh/chaos-mesh)
- [CVE-2025-59360](https://cve.now/CVE-2025-59360.md): OS command injection in Chaos Mesh via the killProcesses mutation (CVSS 9.8, github.com/chaos-mesh/chaos-mesh)
- [CVE-2025-59359](https://cve.now/CVE-2025-59359.md): OS command injection in Chaos Mesh via the cleanTcs mutation (CVSS 9.8, github.com/chaos-mesh/chaos-mesh)
- [CVE-2025-59358](https://cve.now/CVE-2025-59358.md): Denial of Service via Unauthorized Access to Chaos Mesh debugging server (CVSS 7.5, github.com/chaos-mesh/chaos-mesh)
- [CVE-2025-10443](https://cve.now/CVE-2025-10443.md): Tenda AC9/AC15 exeCommand formexeCommand buffer overflow (CVSS 8.7, Tenda AC9 · Tenda AC15)
- [CVE-2025-43794](https://cve.now/CVE-2025-43794.md): Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2 (CVSS 4.6, Liferay Portal · Liferay DXP +1)
- [CVE-2025-10442](https://cve.now/CVE-2025-10442.md): Tenda AC9/AC15 exeCommand formexeCommand os command injection (CVSS 5.3, Tenda AC9 · Tenda AC15)
- [CVE-2025-10441](https://cve.now/CVE-2025-10441.md): D-Link DI-8100G/DI-8200G/DI-8003G jhttpd version\_upgrade.asp sub\_433F7C os command injection (CVSS 5.3, D-Link DI-8100G · D-Link DI-8200G +1)
- [CVE-2025-9072](https://cve.now/CVE-2025-9072.md): One-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter (CVSS 7.6, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-9084](https://cve.now/CVE-2025-9084.md): Open redirect in OAuth login (CVSS 3.1, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-9826](https://cve.now/CVE-2025-9826.md): Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution f (CVSS 7.0, M-Files Hubshare)
- [CVE-2025-9078](https://cve.now/CVE-2025-9078.md): Weak cache keys lead to post IDOR and link preview poisoning (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-9076](https://cve.now/CVE-2025-9076.md): Mattermost Server exposes sensitive user credentials during shared channel membership synchronization (CVSS 6.5, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-10440](https://cve.now/CVE-2025-10440.md): D-Link DI-8100/DI-8100G/DI-8200/DI-8200G/DI-8003/DI-8003G jhttpd usb\_paswd.asp sub\_4621DC os command injection (CVSS 5.3, D-Link DI-8100 · D-Link DI-8100G +4)
- [CVE-2025-10436](https://cve.now/CVE-2025-10436.md): Campcodes Computer Sales and Inventory System sup\_searchfrm.php sql injection (CVSS 6.9, Campcodes Computer Sales and Inventory System)
- [CVE-2025-10435](https://cve.now/CVE-2025-10435.md): Campcodes Computer Sales and Inventory System cust\_edit1.php sql injection (CVSS 6.9, Campcodes Computer Sales and Inventory System)
- [CVE-2025-10434](https://cve.now/CVE-2025-10434.md): IbuyuCMS Add Article article.php cross site scripting (CVSS 4.8, IbuyuCMS)
- [CVE-2025-10433](https://cve.now/CVE-2025-10433.md): 1Panel-dev MaxKB debug deserialization (CVSS 5.3, 1Panel-dev MaxKB)
- [CVE-2025-41713](https://cve.now/CVE-2025-41713.md): WAGO: Vulnerability in hardware switch circuit (CVSS 6.5, WAGO CC100 0751-9301 · WAGO CC100 0751-9301/K000-0005 +22)
- [CVE-2025-10432](https://cve.now/CVE-2025-10432.md): Tenda AC1206 HTTP Request AdvSetMacMtuWa check\_param\_changed stack-based overflow (CVSS 9.3, Tenda AC1206)
- [CVE-2025-10431](https://cve.now/CVE-2025-10431.md): SourceCodester Pet Grooming Management Software ajax\_represent.php sql injection (CVSS 5.3, SourceCodester Pet Grooming Management Software)
- [CVE-2025-10430](https://cve.now/CVE-2025-10430.md): SourceCodester Pet Grooming Management Software barcode.php sql injection (CVSS 5.3, SourceCodester Pet Grooming Management Software)
- [CVE-2025-10453](https://cve.now/CVE-2025-10453.md): PilotGaea Technologies｜O'View MapServer - Server-Side Request Forgery (CVSS 6.9, PilotGaea Technologies O'View MapServer)
- [CVE-2025-10429](https://cve.now/CVE-2025-10429.md): SourceCodester Pet Grooming Management Software ajax\_product.php sql injection (CVSS 5.3, SourceCodester Pet Grooming Management Software)
- [CVE-2025-10428](https://cve.now/CVE-2025-10428.md): SourceCodester Pet Grooming Management Software Setting seo\_setting.php unrestricted upload (CVSS 5.3, SourceCodester Pet Grooming Management Software)
- [CVE-2025-10427](https://cve.now/CVE-2025-10427.md): SourceCodester Pet Grooming Management Software user.php unrestricted upload (CVSS 5.3, SourceCodester Pet Grooming Management Software)
- [CVE-2025-10426](https://cve.now/CVE-2025-10426.md): itsourcecode Online Laundry Management System login.php sql injection (CVSS 6.9, itsourcecode Online Laundry Management System)
- [CVE-2025-10425](https://cve.now/CVE-2025-10425.md): 1000projects Online Student Project Report Submission and Evaluation System student\_controller.php unrestricted upload (CVSS 6.9, 1000projects Online Student Project Report Submission and E…)
- [CVE-2025-10424](https://cve.now/CVE-2025-10424.md): 1000projects Online Student Project Report Submission and Evaluation System faculty\_controller.php unrestricted upload (CVSS 6.9, 1000projects Online Student Project Report Submission and E…)
- [CVE-2025-10423](https://cve.now/CVE-2025-10423.md): newbee-mall kaptcha mallKaptcha Captcha (CVSS 6.3, newbee-mall)
- [CVE-2025-10452](https://cve.now/CVE-2025-10452.md): Gotac｜Statistical Database System - Missing Authentication (CVSS 9.3, Gotac Statistical Database System)
- [CVE-2025-10422](https://cve.now/CVE-2025-10422.md): newbee-mall Order Status paySuccess improper authorization (CVSS 5.3, newbee-mall)
- [CVE-2025-10421](https://cve.now/CVE-2025-10421.md): SourceCodester Student Grading System update\_account.php sql injection (CVSS 5.3, SourceCodester Student Grading System)
- [CVE-2025-10420](https://cve.now/CVE-2025-10420.md): SourceCodester Student Grading System form137.php sql injection (CVSS 5.3, SourceCodester Student Grading System)
- [CVE-2025-10419](https://cve.now/CVE-2025-10419.md): SourceCodester Student Grading System del\_promote.php sql injection (CVSS 5.3, SourceCodester Student Grading System)
- [CVE-2025-10418](https://cve.now/CVE-2025-10418.md): SourceCodester Student Grading System view\_students.php sql injection (CVSS 5.3, SourceCodester Student Grading System)
- [CVE-2025-10417](https://cve.now/CVE-2025-10417.md): Campcodes Grocery Sales and Inventory System ajax.php sql injection (CVSS 6.9, Campcodes Grocery Sales and Inventory System)
- [CVE-2025-45091](https://cve.now/CVE-2025-45091.md): Seafile versions 11.0.18-Pro, 12.0.10, and 12.0.10-Pro are vulnerable to a stored Cross-Site Scripting (XSS) attack. (CVSS 5.4)
- [CVE-2025-46408](https://cve.now/CVE-2025-46408.md): An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push\_HttpService.getNewHttpC (CVSS 9.8)
- [CVE-2025-49089](https://cve.now/CVE-2025-49089.md): wangxutech MoneyPrinterTurbo 1.2.6 allows path traversal via /api/v1/download/ URIs such as /api/v1/download//etc/passwd. (CVSS 6.3, moneyprinterturbo)
- [CVE-2025-50110](https://cve.now/CVE-2025-50110.md): An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse m (CVSS 8.8)
- [CVE-2025-50944](https://cve.now/CVE-2025-50944.md): An issue was discovered in the method push.lite.avtech.com.MySSLSocketFactoryNew.checkServerTrusted in AVTECH EagleEyes 2.0.0. (CVSS 8.8)
- [CVE-2025-52048](https://cve.now/CVE-2025-52048.md): In Frappe 15.x.x before 15.72.0 and 14.x.x before 14.96.10, in the function add\_tag() at \`frappe/desk/doctype/tag/tag.py\` is vulnerable to S (CVSS 6.5)
- [CVE-2025-52053](https://cve.now/CVE-2025-52053.md): TOTOLINK X6000R V9.4.0cu.1360\_B20241207 was found to contain a command injection vulnerability in the sub\_417D74 function via the file\_name (CVSS 9.8)
- [CVE-2025-52344](https://cve.now/CVE-2025-52344.md): Multiple Cross Site Scripting (XSS) vulnerabilities in input fields in Explorance Blue 8.1.2 allows attackers to inject arbitrary JavaScript (CVSS 6.1)
- [CVE-2025-56252](https://cve.now/CVE-2025-56252.md): Cross Site Scripting (xss) vulnerability in ServitiumCRM 2.10 allowing attackers to execute arbitrary code via a crafted URL to the mobile p (CVSS 6.1)
- [CVE-2025-56274](https://cve.now/CVE-2025-56274.md): SourceCodester Web-based Pharmacy Product Management System 1.0 is vulnerable to Incorrect Access Control, which allows low-privileged users (CVSS 8.1)
- [CVE-2025-56448](https://cve.now/CVE-2025-56448.md): The Positron PX360BT SW REV 8 car alarm system is vulnerable to a replay attack due to a failure in implementing rolling code security. (CVSS 6.8)
- [CVE-2025-56710](https://cve.now/CVE-2025-56710.md): A Cross-Site Request Forgery (CSRF) vulnerability was identified in the Profile Page of the PHPGurukul Student-Result-Management-System-Usin (CVSS 7.3)
- [CVE-2025-57104](https://cve.now/CVE-2025-57104.md): Teampel 5.1.6 is vulnerable to SQL Injection in /Common/login.aspx. (CVSS 5.4)
- [CVE-2025-57117](https://cve.now/CVE-2025-57117.md): A Clickjacking vulnerability exists in Rems' Employee Management System 1.0. (CVSS 5.4)
- [CVE-2025-57118](https://cve.now/CVE-2025-57118.md): An issue in PHPGurukul Online-Library-Management-System v3.0 allows an attacker to escalate privileges via the index.php (CVSS 9.8)
- [CVE-2025-57174](https://cve.now/CVE-2025-57174.md): An issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previo (CVSS 9.8)
- [CVE-2025-57176](https://cve.now/CVE-2025-57176.md): On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP po (CVSS 6.5, Ceragon Networks / Siklu Communication EtherHaul and MultiH…)
- [CVE-2025-57248](https://cve.now/CVE-2025-57248.md): A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the processing of a crafted .djvu file. (CVSS 7.3)
- [CVE-2025-59375](https://cve.now/CVE-2025-59375.md): libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsi (CVSS 7.5, libexpat project libexpat)
- [CVE-2025-59376](https://cve.now/CVE-2025-59376.md): feiskyer mcp-kubernetes-server through 0.1.11 does not consider chained commands in the implementation of --disable-write and --disable-dele (CVSS 3.7, feiskyer mcp-kubernetes-server · mcp-kubernetes-server)
- [CVE-2025-59377](https://cve.now/CVE-2025-59377.md): feiskyer mcp-kubernetes-server through 0.1.11 allows OS command injection, even in read-only mode, via /mcp/kubectl because shell=True is us (CVSS 3.7, feiskyer mcp-kubernetes-server · mcp-kubernetes-server)
- [CVE-2025-59378](https://cve.now/CVE-2025-59378.md): In guix-daemon in GNU Guix before 1618ca7, a content-addressed-mirrors file can be written to create a setuid program that allows a regular (CVSS 5.7, GNU Guix)
- [CVE-2025-59397](https://cve.now/CVE-2025-59397.md): Open Web Analytics (OWA) before 1.8.1 allows owa\_db.php v\[value\] SQL injection. (CVSS 5.0, openwebanalytics Open Web Analytics · open-web-analytics/op…)
- [CVE-2025-59398](https://cve.now/CVE-2025-59398.md): The OCPP implementation in libocpp before 0.26.2 allows a denial of service (EVerest crash) via JSON input larger than 255 characters, becau (CVSS 3.1, EVerest libocpp)
- [CVE-2025-59399](https://cve.now/CVE-2025-59399.md): libocpp before 0.28.0 allows a denial of service (EVerest crash) because a secondary exception is thrown during error message generation. (CVSS 3.1, EVerest libocpp)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-09-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.