CVEs published December 8, 2025
245 CVEs were published on December 8, 2025: 10 critical, 81 high. 2 are now in CISA KEV.
- Published
- 245
- Critical
- 10
- High
- 81
- Medium
- 97
- Low
- 7
- Unrated
- 50
- Now in CISA KEV
- 2
- Fix available
- 54
Most affected products
- Linux
- 82
- Google Android
- 58
- Huawei HarmonyOS
- 14
- Enalean tuleap
- 5
- github.com/usememos/memos
- 5
- Infinera MTC-9
- 5
- code-projects Currency Exchange System
- 4
- itsourcecode Student Management System
- 4
- CIRCL Vulnerability-Lookup
- 3
- code-projects Online Ordering System
- 3
Critical 10
- CVE-2025-65964n8n Vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hookn8n-io n8n · n8n
- CVE-2025-27020Improper configuration of SSH service in Infinera MTC-9Infinera MTC-9
- CVE-2025-27019Remote shell service (RSH) in Infinera MTC-9Infinera MTC-9
- CVE-2023-53769virt/coco/sev-guest: Double-buffer messagesLinux
- CVE-2023-53751cifs: fix potential use-after-free bugs in TCP_Server_Info::hostnameLinux
- CVE-2025-40320smb: client: fix potential cfid UAF in smb2_query_info_compoundLinux
- CVE-2025-63721HummerRisk thru v1.5.0 is using a vulnerable Snakeyaml component, allowing attackers with normal user privileges to hit the /rule/add API an
- CVE-2025-64081SQL injection vulnerability in /php/api_patient_schedule.php in SourceCodester Patients Waiting Area Queue Management System v1 allows attac
- CVE-2025-65548NUT-14 allows cashu tokens to be created with a preimage hash.cashu
- CVE-2025-65849A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Woaltcha
High 81
- CVE-2025-14261Lack of entropy allows registered low-privileged users of Litmus to crack valid JWT tokens and gain admin privilegesLitmuschaos litmus
- CVE-2025-48625In multiple locations of UsbDataAdvancedProtectionHook.java, there is a possible way to access USB data when the screen is off due to a raceGoogle Android
- CVE-2025-48606In preparePackage of InstallPackageHelper.java, there is a possible way for an app to appear hidden upon installation without a mechanism toGoogle Android
- CVE-2025-48639In DefaultTransitionHandler.java, there is a possible way to unknowingly grant permissions to an app due to a tapjacking/overlay attack.Google Android
- CVE-2025-48638In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to improper input validation.Google Android
- CVE-2025-48637In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow.Google Android
- CVE-2025-48632In setDisplayName of AssociationRequest.java, there is a possible way to cause CDM associations to persist after the user has disassociated Google Android
- CVE-2025-48629In findAvailRecognizer of VoiceInteractionManagerService.java, there is a possible way to become the default speech recognizer app due to anGoogle Android
- CVE-2025-48628In validateIconUserBoundary of PrintManagerService.java, there is a possible cross-user image leak due to a confused deputy.Google Android
- CVE-2025-48627In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to launch an activity from the background due to a Google Android
- CVE-2025-48626In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure.Google Android
- CVE-2025-48624In multiple functions of arm-smmu-v3.c, there is a possible out-of-bounds write due to improper input validation.Google Android
- CVE-2025-48623In init_pkvm_hyp_vcpu of pkvm.c, there is a possible out of bounds write due to improper input validation.Google Android
- CVE-2025-48621In DefaultTransitionHandler.java, there is a possible way to enable a tapjacking attack due to a insecure default.Google Android
- CVE-2025-48620In onSomePackagesChanged of VoiceInteractionManagerService.java, there is a possible way for a third party application's component name to pGoogle Android
- CVE-2025-48615In getComponentName of MediaButtonReceiverHolder.java, there is a possible desync in persistence due to resource exhaustion.Google Android
- CVE-2025-48612In setDefaultKey of DefaultPaymentSettings.java, there is a possible way for an application to set the main user's default NFC payment settiGoogle Android
- CVE-2025-48599In multiple functions of WifiScanModeActivity.java, there is a possible way to bypass a device config restriction due to a missing permissioGoogle Android
- CVE-2025-48597In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack.Google Android
- CVE-2025-48596In appendFrom of Parcel.cpp, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2025-48594In onUidImportance of DisassociationProcessor.java, there is a possible way to retain companion application privileges after disassociation Google Android
- CVE-2025-48589In multiple functions of HeaderPrivacyIconsController.kt, there is a possible way to grand permissions across user due to a logic error in Google Android
- CVE-2025-48588In startAlwaysOnVpn of Vpn.java, there is a possible way to disable always-on VPN due to a logic error in the code.Google Android
- CVE-2025-48586In onActivityResult of EditFdnContactScreen.java, there is a possible way to leak contacts from the work profile due to a confused deputy.Google Android
- CVE-2025-48583In multiple functions of BaseBundle.java, there is a possible way to execute arbitrary code due to a logic error in the code.Google Android
- CVE-2025-48580In connectInternal of MediaBrowser.java, there is a possible way to access while in use permission while the app is in background due to a lGoogle Android
- CVE-2025-48575In multiple functions of CertInstaller.java, there is a possible way to install certificates due to a permissions bypass.Google Android
- CVE-2025-48573In sendCommand of MediaSessionRecord.java, there is a possible way to launch the foreground service while the app is in the background due tGoogle Android
- CVE-2025-48572In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass.Google Android
- CVE-2025-48566In multiple locations, there is a possible permission bypass due to a confused deputy.Google Android
- CVE-2025-48565In multiple locations, there is a possible way to bypass the cross profile intent filter due to a logic error in the code.Google Android
- CVE-2025-48564In multiple locations, there is a possible intent filter bypass due to a race condition.Google Android
- CVE-2025-48555In multiple functions of NotificationStation.java, there is a possible cross-profile information disclosure due to a confused deputy.Google Android
- CVE-2025-48536In grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible way for a third party app to modify secure settingsGoogle Android
- CVE-2025-48525In disassociate of DisassociationProcessor.java, there is a possible way for an app to continue reading notifications when not associated toGoogle Android
- CVE-2025-32329In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic errGoogle Android
- CVE-2025-32328In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic errGoogle Android
- CVE-2025-22420In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy.Google Android
- CVE-2025-42620CSRF vulnerability in CIRCL Vulnerability-LookupCIRCL Vulnerability-Lookup
- CVE-2025-42616CSRF vulnerability in CIRCL Vulnerability-LookupCIRCL Vulnerability-Lookup
- CVE-2025-42615Improper Restriction of Excessive Authentication Attempts vulnerability in CIRCL Vulnerability-LookupCIRCL Vulnerability-Lookup
- CVE-2025-26488Improper input validation in XML Management service in Infinera MTC-9Infinera MTC-9
- CVE-2025-26487Server Side Request Forgery (SSRF) in the web server of Infinera MTC-9Infinera MTC-9
- CVE-2025-12956Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025xDassault Systèmes ENOVIA Collaborative Industry Innovator
- CVE-2025-66328Multi-thread race condition vulnerability in the network management module.Huawei HarmonyOS
- CVE-2025-66327Race condition vulnerability in the network module.Huawei HarmonyOS
- CVE-2025-66324Input verification vulnerability in the compression and decompression module.Huawei HarmonyOS
- CVE-2025-14255Galaxy Software Services｜Vitals ESP - SQL InjectionGalaxy Software Services Vitals ESP
- CVE-2025-14254Galaxy Software Services｜Vitals ESP - SQL InjectionGalaxy Software Services Vitals ESP
- CVE-2023-53768regmap-irq: Fix out-of-bounds access when allocating config buffersLinux
- CVE-2023-53764wifi: ath12k: Handle lock during peer_id findLinux
- CVE-2023-53763Revert "f2fs: fix to do sanity check on extent cache correctly"Linux
- CVE-2023-53762Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_syncLinux
- CVE-2023-53759HID: hidraw: fix data race on device refcountLinux
- CVE-2023-53753drm/amd/display: fix mapping to non-allocated addressLinux
- CVE-2023-53752net: deal with integer overflows in kmalloc_reserve()Linux
- CVE-2023-53748media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setupLinux
- CVE-2023-53747vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAFLinux
- CVE-2022-50630mm: hugetlb: fix UAF in hugetlb_handle_userfaultLinux
- CVE-2022-50623fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()Linux
- CVE-2025-40326NFSD: Define actions for the new time_deleg FATTR4 attributesLinux
- CVE-2025-40324NFSD: Fix crash in nfsd4_read_release()Linux
- CVE-2025-40323fbcon: Set fb_display[i]->mode to NULL when the mode is releasedLinux
- CVE-2025-40322fbdev: bitblit: bound-check glyph index in bit_putcs*Linux
- CVE-2025-40319bpf: Sync pending IRQ work before freeing ring bufferLinux
- CVE-2025-40318Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_onceLinux
- CVE-2025-40317regmap: slimbus: fix bus_context pointer in regmap init callsLinux
- CVE-2025-40309Bluetooth: SCO: Fix UAF on sco_conn_freeLinux
- CVE-2025-40307exfat: validate cluster allocation bits of the allocation bitmapLinux
- CVE-2025-40306orangefs: fix xattr related buffer overflow...Linux
- CVE-2025-40304fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-boundsLinux
- CVE-2025-40303btrfs: ensure no dirty metadata is written back for an fs with errorsLinux
- CVE-2025-40302media: videobuf2: forbid remove_bufs when legacy fileio is activeLinux
- CVE-2025-40301Bluetooth: hci_event: validate skb length for unknown CC opcodeLinux
- CVE-2025-40297net: bridge: fix use-after-free due to MST port state bypassLinux
- CVE-2025-40292virtio-net: fix received length check in big packetsLinux
- CVE-2025-40291io_uring: fix regbuf vector size truncationLinux
- CVE-2025-40290xsk: avoid data corruption on cq descriptor numberLinux
- CVE-2025-65271Client-side template injection (CSTI) in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the c
- CVE-2025-65363Authenticated append-style command-injection Ruijie APs (AP_RGOS 11.1.x) allows an authenticated web user to execute appended shell expressi
- CVE-2025-65795Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts vgithub.com/usememos/memos
Medium, low and unrated 154
- CVE-2022-50632drivers: perf: marvell_cn10k: Fix hotplug callback leak in tad_pmu_init()Linux
- CVE-2022-50631RISC-V: kexec: Fix memory leak of fdt bufferLinux
- CVE-2025-66469NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injectionzauberzeug nicegui · nicegui
- CVE-2025-66204WBCE CMS allows brute-force protection bypass using X-Forwarded-For headerWBCE_CMS
- CVE-2025-66202Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765withastro astro · astro
- CVE-2025-65962Tuleap has missing CSRF protections its in tracker field dependenciesEnalean tuleap
- CVE-2025-64760Tuleap has missing CSRF protections in its tracker trigger management systemEnalean tuleap
- CVE-2025-64499Tuleap is missing CSRF protections for its planning management APIEnalean tuleap
- CVE-2025-64498Tuleap has a Cross-Site Request Forgery (CSRF) vulnerabilityEnalean tuleap
- CVE-2025-64497Tuleap exposes releases for all projects to File Release System project administratorsEnalean tuleap
- CVE-2025-36140IBM watsonx.data Denial of ServiceIBM watsonx.data
- CVE-2025-62408c-ares has a Use After Free vulnerability when connection is cleaned up after errorc-ares
- CVE-2025-12635IBM WebSphere Application Server and WebSphere Application Server Liberty Cross-Site ScriptingIBM WebSphere Application Server
- CVE-2025-64650IBM Storage Defender - Resiliency Service Information DisclosureIBM Storage Defender - Resiliency Service
- CVE-2025-12832IBM InfoSphere Information Server Server-Side Request ForgeryIBM InfoSphere Information Server
- CVE-2025-36017IBM Controller Information DisclosureIBM Controller
- CVE-2025-14276Ilevia EVE X1 Server leaf_search.php command injectionIlevia EVE X1 Server
- CVE-2025-36102IBM Controller Validation BypassIBM Controller · IBM Cognos Controller
- CVE-2025-33111IBM Controller Information DisclosureIBM Controller · IBM Cognos Controller
- CVE-2025-36015IBM Controller Denial of ServiceIBM Controller · IBM Cognos Controller
- CVE-2025-14259Jihai Jshop MiniProgram Mall System api.html sql injectionJihai Jshop MiniProgram Mall System
- CVE-2025-14258itsourcecode Student Management System newsubject.php sql injectionitsourcecode Student Management System
- CVE-2025-48608In isValidMediaUri of SettingsProvider.java, there is a possible cross user media read due to a missing permission check.Google Android
- CVE-2025-48569In multiple locations, there is a possible permanent denial of service due to resource exhaustion.Google Android
- CVE-2025-14257itsourcecode Student Management System newrecord.php sql injectionitsourcecode Student Management System
- CVE-2025-48633In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic Google Android
- CVE-2025-48631In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion.Google Android
- CVE-2025-48622In ProcessArea of dng_misc_opcodes.cpp, there is a possible out of bounds read due to a buffer overflow.Google Android
- CVE-2025-48618In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking.Google Android
- CVE-2025-48614In rebootWipeUserData of RecoverySystem.java, there is a possible way to factory reset the device while in DSU mode due to a missing permissGoogle Android
- CVE-2025-48610In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible configuration data leak due to a logic error in the code.Google Android
- CVE-2025-48607In multiple locations, there is a possible way to create a large amount of app ops due to a logic error in the code.Google Android
- CVE-2025-48604In multiple locations, there is a possible way to read files from another user due to a missing permission check.Google Android
- CVE-2025-48603In InputMethodInfo of InputMethodInfo.java, there is a possible permanent denial of service due to resource exhaustion.Google Android
- CVE-2025-48601In multiple locations, there is a possible permanent denial of service due to improper input validation.Google Android
- CVE-2025-48600In multiple files, there is a possible way to reveal information across users due to a missing permission check.Google Android
- CVE-2025-48598In multiple locations, there is a possible way to alter the primary user's face unlock settings due to a confused deputy.Google Android
- CVE-2025-48592In initDecoder of C2SoftDav1dDec.cpp, there is a possible out of bounds read due to a heap buffer overflow.Google Android
- CVE-2025-48591In multiple locations, there is a possible way to read files from another user due to a missing permission check.Google Android
- CVE-2025-48590In verifyAndGetBypass of AppOpsService.java, there is a possible method for a malicious app to prevent dialing emergency services under limiGoogle Android
- CVE-2025-48584In multiple functions of NotificationManagerService.java, there is a possible way to bypass the per-package channel limits causing resource Google Android
- CVE-2025-48576In updateNotificationChannelGroupFromPrivilegedListener of NotificationManagerService.java, there is a possible permanent denial of service Google Android
- CVE-2025-32319In ensureBound of RemotePrintService.java, there is a possible way for a background app to keep foreground permissions due to a permissions Google Android
- CVE-2025-22432In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input validation.Google Android
- CVE-2025-14256itsourcecode Student Management System newcurriculm.php sql injectionitsourcecode Student Management System
- CVE-2025-14251code-projects Online Ordering System Admin Login admin sql injectioncode-projects Online Ordering System
- CVE-2025-14250code-projects Online Ordering System user_contact.php sql injectioncode-projects Online Ordering System
- CVE-2025-14249code-projects Online Ordering System user_school.php sql injectioncode-projects Online Ordering System
- CVE-2025-14248code-projects Simple Shopping Cart adminlogin.php sql injectioncode-projects Simple Shopping Cart
- CVE-2025-14247code-projects Simple Shopping Cart additems.php sql injectioncode-projects Simple Shopping Cart
- CVE-2025-14246code-projects Simple Shopping Cart settings.php sql injectioncode-projects Simple Shopping Cart
- CVE-2025-14245IdeaCMS Coupon.php whereRaw sql injectionIdeaCMS
- CVE-2025-14244GreenCMS Menu Management CustomController.class.php cross site scriptingGreenCMS
- CVE-2025-14230code-projects Daily Time Recording System add_payroll.php sql injectioncode-projects Daily Time Recording System
- CVE-2025-14229SourceCodester Inventory Management System SVC Report Export csv injectionSourceCodester Inventory Management System
- CVE-2025-14228Yealink SIP-T21P E2 Local Directory cross site scriptingYealink SIP-T21P E2
- CVE-2025-14227Philipinho Simple-PHP-Blog edit.php sql injectionPhilipinho Simple-PHP-Blog
- CVE-2025-14262Jobs can be saved as workflows with wrong permissions on KNIME Business HubKNIME Business Hub
- CVE-2025-14226itsourcecode Student Management System edit_user.php sql injectionitsourcecode Student Management System
- CVE-2025-66461FULLBACK Manager Pro provided by GS Yuasa International Ltd.GS Yuasa International FULLBACK Manager Pro
- CVE-2025-14225D-Link DCS-930L alphapd setSystemAdmin command injectionD-Link DCS-930L
- CVE-2025-26489Improper input validation in Netconf service in Infinera MTC-9Infinera MTC-9
- CVE-2025-66330App lock verification bypass vulnerability in the file management app.Huawei HarmonyOS
- CVE-2025-66329Permission control vulnerability in the window management module.Huawei HarmonyOS · Huawei EMUI
- CVE-2025-14224Yottamaster DM2/DM3/DM200 File Upload path traversalYottamaster DM2 · Yottamaster DM3 +1
- CVE-2025-66325Permission control vulnerability in the package management module.Huawei HarmonyOS · Huawei EMUI
- CVE-2025-58279Permission control vulnerability in the media library module.Huawei HarmonyOS
- CVE-2025-66334Denial of service (DoS) vulnerability in the office service.Huawei HarmonyOS
- CVE-2025-66333Denial of service (DoS) vulnerability in the office service.Huawei HarmonyOS
- CVE-2025-66332Denial of service (DoS) vulnerability in the office service.Huawei HarmonyOS
- CVE-2025-66331Denial of service (DoS) vulnerability in the office service.Huawei HarmonyOS
- CVE-2025-66326Race condition vulnerability in the audio module.Huawei HarmonyOS
- CVE-2025-66323Vulnerability of improper criterion security check in the card module.Huawei HarmonyOS
- CVE-2025-14223code-projects Simple Leave Manager request.php sql injectioncode-projects Simple Leave Manager
- CVE-2025-66322Multi-thread race condition vulnerability in the camera framework module.Huawei HarmonyOS
- CVE-2025-66321Multi-thread race condition vulnerability in the camera framework module.Huawei HarmonyOS
- CVE-2025-66320Multi-thread race condition vulnerability in the camera framework module.Huawei HarmonyOS
- CVE-2025-14253Galaxy Software Services｜Vitals ESP - Arbitrary File ReadGalaxy Software Services Vitals ESP
- CVE-2025-14222code-projects Employee Profile Management System print_personnel_report.php sql injectioncode-projects Employee Profile Management System
- CVE-2025-14221SourceCodester Online Banking System page cross site scriptingSourceCodester Online Banking System
- CVE-2025-14220ORICO CD3510 File Upload path traversalORICO CD3510
- CVE-2025-14219Campcodes Retro Basketball Shoes Online Store admin_running.php unrestricted uploadCampcodes Retro Basketball Shoes Online Store
- CVE-2025-14218code-projects Currency Exchange System editotheraccount.php sql injectioncode-projects Currency Exchange System
- CVE-2025-14217code-projects Currency Exchange System edittrns.php sql injectioncode-projects Currency Exchange System
- CVE-2025-14216code-projects Currency Exchange System viewserial.php sql injectioncode-projects Currency Exchange System
- CVE-2025-14215code-projects Currency Exchange System edit.php sql injectioncode-projects Currency Exchange System
- CVE-2025-14214itsourcecode Student Information System section_edit1.php sql injectionitsourcecode Student Information System
- CVE-2025-14212projectworlds Advanced Library Management System member_search.php sql injectionprojectworlds Advanced Library Management System
- CVE-2025-14211projectworlds Advanced Library Management System delete_book.php sql injectionprojectworlds Advanced Library Management System
- CVE-2025-14210projectworlds Advanced Library Management System delete_member.php sql injectionprojectworlds Advanced Library Management System
- CVE-2025-14209Campcodes School File Management System update_query.php sql injectionCampcodes School File Management System
- CVE-2023-53767wifi: ath12k: fix memory leak in ath12k_qmi_driver_event_work()Linux
- CVE-2023-53766FS: JFS: Check for read-only mounted filesystem in txBeginLinux
- CVE-2023-53765dm cache: free background tracker's queued work in btracker_destroyLinux
- CVE-2023-53761USB: usbtmc: Fix direction for 0-length ioctl control messagesLinux
- CVE-2023-53760scsi: ufs: core: mcq: Fix &hwq->cq_lock deadlock issueLinux
- CVE-2023-53758spi: atmel-quadspi: Free resources even if runtime resume failed in .remove()Linux
- CVE-2023-53757irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probeLinux
- CVE-2023-53756KVM: VMX: Fix crash due to uninitialized current_vmcsLinux
- CVE-2023-53755dmaengine: ptdma: check for null desc before calling pt_cmd_callbackLinux
- CVE-2023-53754scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()Linux
- CVE-2023-53750pinctrl: freescale: Fix a memory out of bounds when num_configs is 1Linux
- CVE-2023-53746s390/vfio-ap: fix memory leak in vfio_ap device driverLinux
- CVE-2023-53745um: vector: Fix memory leak in vector_configLinux
- CVE-2023-53744soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probeLinux
- CVE-2023-53743PCI: Free released resource after coalescingLinux
- CVE-2023-53742kcsan: Avoid READ_ONCE() in read_instrumented_memory()Linux
- CVE-2022-50629wifi: rsi: Fix memory leak in rsi_coex_attach()Linux
- CVE-2022-50628drm/gud: Fix UBSAN warningLinux
- CVE-2022-50627wifi: ath11k: fix monitor mode bringup crashLinux
- CVE-2022-50626media: dvb-usb: fix memory leak in dvb_usb_adapter_init()Linux
- CVE-2022-50625serial: amba-pl011: avoid SBSA UART accessing DMACR registerLinux
- CVE-2022-50624net: netsec: fix error handling in netsec_register_mdio()Linux
- CVE-2022-50622ext4: fix potential memory leak in ext4_fc_record_modified_inode()Linux
- CVE-2022-50621dm: verity-loadpin: Only trust verity targets with enforcementLinux
- CVE-2022-50620f2fs: fix to invalidate dcc->f2fs_issue_discard in error pathLinux
- CVE-2022-50619drm/amdkfd: Fix memory leak in kfd_mem_dmamap_userptr()Linux
- CVE-2022-50618mmc: meson-gx: fix return value check of mmc_add_host()Linux
- CVE-2022-50617drm/amdgpu/powerplay/psm: Fix memory leak in power state initLinux
- CVE-2022-50616regulator: core: Use different devices for resource allocation and DT lookupLinux
- CVE-2022-50615perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map()Linux
- CVE-2022-50614misc: pci_endpoint_test: Fix pci_endpoint_test_{copy,write,read}() panicLinux
- CVE-2022-50583md/raid0, raid10: Don't set discard sectors for request queueLinux
- CVE-2025-14208D-Link DIR-823X set_wan_settings sub_415028 command injectionD-Link DIR-823X
- CVE-2025-40321wifi: brcmfmac: fix crash while sending Action Frames in standalone AP ModeLinux
- CVE-2025-40316drm/mediatek: Fix device use-after-free on unbindLinux
- CVE-2025-40315usb: gadget: f_fs: Fix epfile null pointer access after ep enable.Linux
- CVE-2025-40314usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadgetLinux
- CVE-2025-40313ntfs3: pretend $Extend records as regular filesLinux
- CVE-2025-40312jfs: Verify inode mode when loading from diskLinux
- CVE-2025-40311accel/habanalabs: support mapping cb with vmalloc-backed coherent memoryLinux
- CVE-2025-40310amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_swLinux
- CVE-2025-40308Bluetooth: bcsp: receive data only if registeredLinux
- CVE-2025-403059p/trans_fd: p9_fd_request: kick rx thread if EPOLLINLinux
- CVE-2025-40299gve: Implement gettimex64 with -EOPNOTSUPPLinux
- CVE-2025-40298gve: Implement settime64 with -EOPNOTSUPPLinux
- CVE-2025-40296platform/x86: int3472: Fix double free of GPIO device during unregisterLinux
- CVE-2025-40295fscrypt: fix left shift underflow when inode->i_blkbits > PAGE_SHIFTLinux
- CVE-2025-40294Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()Linux
- CVE-2025-40293iommufd: Don't overflow during division for dirty trackingLinux
- CVE-2025-14207tushar-2223 Hotel-Management-System invoiceprint.php sql injectiontushar-2223 Hotel-Management-System
- CVE-2025-14206SourceCodester Online Student Clearance System Fee Table delete-fee.php improper authorizationSourceCodester Online Student Clearance System
- CVE-2025-59391A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches.
- CVE-2025-60912phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality.
- CVE-2025-61318Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability.
- CVE-2025-65228A stored cross-site scripting vulnerability exists in the web management interface of the R.V.R.
- CVE-2025-65229A stored cross-site scripting (XSS) vulnerability exists in the web interface of Lyrion Music Server <= 9.0.3.
- CVE-2025-65230Barix Instreamer v04.06 and v04.05 contains a stored cross-site scripting (XSS) vulnerability in the Web UI Configuration Streaming Destinat
- CVE-2025-65231Barix Instreamer v04.06 and earlier is vulnerable to Cross Site Scripting (XSS) in the Web UI I/O & Serial configuration page, specifically
- CVE-2025-65796Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily delete reactions made to other github.com/usememos/memos
- CVE-2025-65797Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarilgithub.com/usememos/memos
- CVE-2025-65798Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete attachments magithub.com/usememos/memos
- CVE-2025-65799A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path travergithub.com/usememos/memos
- CVE-2025-65804Tenda AX3 v16.03.12.11 contains a stack overflow in formSetIptv via the iptvType parameter, which can cause memory corruption and enable rem