Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-20 16:43Z
2025-08-19
2025-08-19 17:15Z
HIGH

CVE-2025-38608 — Linux Linux_kernel: This results in transmitting buffers containing uninitialized data during ciphertext transmission.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38608

In the Linux kernel, the following vulnerability has been resolved: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls When sending plaintext data, we initially calculated the corresponding ciphertext length. However, if we later reduced the plaintext data length via socket policy, we failed to recalculate the ciphertext length. This results in transmitting buffers containing uninitialized data during ciphertext transmission. This causes uninitialized by CVSSv3.1 8.6 (HIGH) · EPSS 7th percentile

CWECWE 908TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2025-08-19
2025-08-19 17:15Z
HIGH

CVE-2025-38601 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: clear initialized

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38601

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: clear initialized flag for deinit-ed srng lists In a number of cases we see kernel panics on resume due to ath11k kernel page fault, which happens under the following circumstances: 1) First ath11k_hal_dump_srng_stats() call Last interrupt received for each group: ath11k_pci 0000:01:00.0: group_id 0 22511ms before ath11k_pci 0000:01:00.0: group_id 1 14440788ms before [..] ath11k_pci 000 CVSSv3.1 8.8 (HIGH) · EPSS 5th percentile

CWECWE 909TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-08-19
2025-08-19 17:15Z
HIGH

CVE-2025-38600 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38600

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan() The ssid->ssids[] and sreq->ssids[] arrays have MT7925_RNR_SCAN_MAX_BSSIDS elements so this >= needs to be > to prevent an out of bounds access. CVSSv3.1 8.8 (HIGH) · EPSS 3th percentile

CWECWE 193TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-08-19
2025-08-19 17:15Z
HIGH

CVE-2025-38599 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38599

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible OOB access in mt7996_tx() Fis possible Out-Of-Boundary access in mt7996_tx routine if link_id is set to IEEE80211_LINK_UNSPECIFIED CVSSv3.1 8.8 (HIGH) · EPSS 4th percentile

CWECWE 125TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-08-19
2025-08-19 17:15Z
HIGH

CVE-2025-38592 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_devcd_dump: fix out-of-bounds

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38592

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_devcd_dump: fix out-of-bounds via dev_coredumpv Currently both dev_coredumpv and skb_put_data in hci_devcd_dump use hdev->dump.head. However, dev_coredumpv can free the buffer. From dev_coredumpm_timeout documentation, which is used by dev_coredumpv: > Creates a new device coredump for the given device. If a previous one hasn't > been read yet, the new coredump is discarded. The data CVSSv3.1 8.8 (HIGH) · EPSS 6th percentile

CWECWE 125TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-08-19
2025-08-19 17:15Z
HIGH

CVE-2025-38574 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: pptp: ensure minimal skb

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38574

In the Linux kernel, the following vulnerability has been resolved: pptp: ensure minimal skb length in pptp_xmit() Commit aabc6596ffb3 ("net: ppp: Add bound checking for skb data on ppp_sync_txmung") fixed ppp_sync_txmunge() We need a similar fix in pptp_xmit(), otherwise we might read uninit data as reported by syzbot. BUG: KMSAN: uninit-value in pptp_xmit+0xc34/0x2720 drivers/net/ppp/pptp.c:193 pptp_xmit+0xc34/0x2720 drivers/net/ppp/pptp.c:193 ppp_channel_bridge_inp CVSSv3.1 8.6 (HIGH) · EPSS 8th percentile

CWECWE 908TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2025-08-19
2025-08-19 17:15Z
HIGH

CVE-2025-38571 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix client side

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38571

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix client side handling of tls alerts A security exploit was discovered in NFS over TLS in tls_alert_recv due to its assumption that there is valid data in the msghdr's iterator's kvec. Instead, this patch proposes the rework how control messages are setup and used by sock_recvmsg(). If no control message structure is setup, kTLS layer will read and process TLS data record types. As soon as it en CVSSv3.1 8.2 (HIGH) · EPSS 5th percentile

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-08-19
2025-08-19 17:15Z
CRIT

CVE-2025-38566 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix handling of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38566

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix handling of server side tls alerts Scott Mayhew discovered a security exploit in NFS over TLS in tls_alert_recv() due to its assumption it can read data from the msg iterator's kvec.. kTLS implementation splits TLS non-data record payload between the control message buffer (which includes the type such as TLS aler or TLS cipher change) and the rest of the payload (say TLS alert's level/descript CVSSv3.1 9.8 (CRITICAL) · EPSS 44th percentile

CWECWE 754TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-08-19
2025-08-19 17:15Z
CRIT

CVE-2025-38561 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix Preauh_HashValue race

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38561

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix Preauh_HashValue race condition If client send multiple session setup requests to ksmbd, Preauh_HashValue race condition could happen. There is no need to free sess->Preauh_HashValue at session setup phase. It can be freed together with session at connection termination phase. CVSSv3.1 9.8 (CRITICAL) · EPSS 33th percentile

CWECWE 362TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-08-19
2025-08-19 17:15Z
CRIT

CVE-2025-38560 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: x86/sev: Evict cache lines

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38560

In the Linux kernel, the following vulnerability has been resolved: x86/sev: Evict cache lines during SNP memory validation An SNP cache coherency vulnerability requires a cache line eviction mitigation when validating memory after a page state change to private. The specific mitigation is to touch the first and last byte of each 4K page that is being validated. There is no need to perform the mitigation when performing a page state change to shared and rescinding validatio CVSSv3.1 9.3 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2025-08-19
2025-08-19 14:15Z
CRIT

CVE-2025-50567 — Saurus: This leads to injection of user-controlled SQL statements, potentially leading to arbitrary PHP code

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-50567

Saurus CMS Community Edition 4.7.1 contains a vulnerability in the custom DB::prepare() function, which uses preg_replace() with the deprecated /e (eval) modifier to interpolate SQL query parameters. This leads to injection of user-controlled SQL statements, potentially leading to arbitrary PHP code execution. CVSSv3.1 10.0 (CRITICAL) · EPSS 49th percentile

CWECWE 89CWECWE 94VNDSaurusTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2025-08-16
2025-08-16 14:15Z
CRIT

CVE-2023-4515 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate command request

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-4515

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate command request size In commit 2b9b8f3b68ed ("ksmbd: validate command payload size"), except for SMB2_OPLOCK_BREAK_HE command, the request size of other commands is not checked, it's not expected. Fix it by add check for request size of other commands. CVSSv3.1 9.1 (CRITICAL) · EPSS 4th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-08-16
2025-08-16 14:15Z
HIGH

CVE-2023-4130 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix wrong next

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-4130

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea() There are multiple smb2_ea_info buffers in FILE_FULL_EA_INFORMATION request from client. ksmbd find next smb2_ea_info using ->NextEntryOffset of current smb2_ea_info. ksmbd need to validate buffer length Before accessing the next ea. ksmbd should check buffer length using buf_len, not next variable. next is the start offset of current ea CVSSv3.1 8.1 (HIGH) · EPSS 14th percentile

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-08-16
2025-08-16 14:15Z
CRIT

CVE-2023-3867 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3867

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds read in smb2_sess_setup ksmbd does not consider the case of that smb2 session setup is in compound request. If this is the second payload of the compound, OOB read issue occurs while processing the first payload in the smb2_sess_setup(). CVSSv3.1 9.1 (CRITICAL) · EPSS 87th percentile

CWECWE 125TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-08-16
2025-08-16 14:15Z
HIGH

CVE-2023-3866 — Linux Linux_kernel: If first operation in the compound is SMB2 ECHO request, ksmbd bypass session and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3866

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in the compound request This patch validate session id and tree id in compound request. If first operation in the compound is SMB2 ECHO request, ksmbd bypass session and tree validation. So work->sess and work->tcon could be NULL. If secound request in the compound access work->sess or tcon, It cause NULL pointer dereferecing error. CVSSv3.1 7.5 (HIGH) · EPSS 97th percentile

CWECWE 476TYPVulnerability
7.5
CVSS v3.1
92
Edit Score
2025-08-16
2025-08-16 14:15Z
HIGH

CVE-2023-3865 — Linux Linux_kernel: If ->NextCommand is bigger than Offset + Length of smb2 write, It will allow

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3865

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bound read in smb2_write ksmbd_smb2_check_message doesn't validate hdr->NextCommand. If ->NextCommand is bigger than Offset + Length of smb2 write, It will allow oversized smb2 write length. It will cause OOB read in smb2_write. CVSSv3.1 8.1 (HIGH) · EPSS 29th percentile

CWECWE 125TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-08-16
2025-08-16 14:15Z
CRIT

CVE-2023-32249 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ksmbd: not allow guest

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-32249

In the Linux kernel, the following vulnerability has been resolved: ksmbd: not allow guest user on multichannel This patch return STATUS_NOT_SUPPORTED if binding session is guest. CVSSv3.1 9.1 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-08-16
2025-08-16 12:15Z
CRIT

CVE-2025-38552 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: mptcp: plug races between

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38552

In the Linux kernel, the following vulnerability has been resolved: mptcp: plug races between subflow fail and subflow creation We have races similar to the one addressed by the previous patch between subflow failing and additional subflow creation. They are just harder to trigger. The solution is similar. Use a separate flag to track the condition 'socket state prevent any additional subflow creation' protected by the fallback lock. The socket fallback makes such flag tr CVSSv3.1 9.4 (CRITICAL) · EPSS 5th percentile

TYPVulnerability
9.4
CVSS v3.1
97
Edit Score
2025-08-16
2025-08-16 12:15Z
CRIT

CVE-2025-38533 — Linux Linux_kernel: This could lead to undefined behavior, including DMA errors or use-after-free, if the uninitialized

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38533

In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix the using of Rx buffer DMA The wx_rx_buffer structure contained two DMA address fields: 'dma' and 'page_dma'. However, only 'page_dma' was actually initialized and used to program the Rx descriptor. But 'dma' was uninitialized and used in some paths. This could lead to undefined behavior, including DMA errors or use-after-free, if the uninitialized 'dma' was used. Althrough such error has n CVSSv3.1 9.8 (CRITICAL) · EPSS 4th percentile

CWECWE 787TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-08-16
2025-08-16 12:15Z
CRIT

CVE-2025-38527 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38527

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifs_oplock_break A race condition can occur in cifs_oplock_break() leading to a use-after-free of the cinode structure when unmounting: cifs_oplock_break() _cifsFileInfo_put(cfile) cifsFileInfo_put_final() cifs_sb_deactive() [last ref, start releasing sb] kill_sb() kill_anon_super() generic_shutdown_ CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

CWECWE 416TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-08-16
2025-08-16 11:15Z
HIGH

CVE-2025-38512 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: wifi: prevent A-MSDU attacks

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38512

In the Linux kernel, the following vulnerability has been resolved: wifi: prevent A-MSDU attacks in mesh networks This patch is a mitigation to prevent the A-MSDU spoofing vulnerability for mesh networks. The initial update to the IEEE 802.11 standard, in response to the FragAttacks, missed this case (CVE-2025-27558). It can be considered a variant of CVE-2020-24588 but for mesh networks. This patch tries to detect if a standard MSDU was turned into an A-MSDU by an adversa CVSSv3.1 8.8 (HIGH) · EPSS 5th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-08-16
2025-08-16 11:15Z
HIGH

CVE-2025-38511 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Clear all LMTT

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38511

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Clear all LMTT pages on alloc Our LMEM buffer objects are not cleared by default on alloc and during VF provisioning we only setup LMTT PTEs for the actually provisioned LMEM range. But beyond that valid range we might leave some stale data that could either point to some other VFs allocations or even to the PF pages. Explicitly clear all new LMTT page to avoid the risk that a malicious VF would CVSSv3.1 8.8 (HIGH) · EPSS 4th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-08-16
2025-08-16 07:15Z
CRIT

CVE-2025-8898 — Taxi: The Taxi Booking Manager for Woocommerce | E-cab plugin for WordPress is vulnerable to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-8898

The Taxi Booking Manager for Woocommerce | E-cab plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.0. This is due to the plugin not properly validating a user's capabilities prior to updating a plugin setting or their identity prior to updating their details like email address. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and le CVSSv3.1 9.8 (CRITICAL)

CWECWE 862VNDTaxiTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-08-16
2025-08-16 04:16Z
CRIT

CVE-2025-7441 — StoryChief: The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-7441

The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSSv3.1 9.8 (CRITICAL)

CWECWE 434VNDStorychiefTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-08-16
2025-08-16 04:15Z
HIGH

CVE-2025-6079 — School: The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-6079

The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the homework.php file in all versions up to, and including, 93.2.0. This makes it possible for authenticated attackers, with Student-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2025-31100 is potentially a duplicate of this. CVSSv3.1 8.8 (HIGH)

CWECWE 434VNDSchoolTYPVulnerability
8.8
CVSS v3.1
94
Edit Score