deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-53717
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()

Fix a stack-out-of-bounds write that occurs in a WMI response callback
function that is called after a timeout occurs in ath9k_wmi_cmd().
The callback writes to wmi->cmd_rsp_buf, a stack-allocated buffer that
could no longer be valid when a timeout occurs. Set wmi->last_seq_id to
0 when a timeout occurred.

Found by a modified version of syzkaller.

BUG: KASAN: stack-out-of-bounds in ath9k_wmi_ctrl_rx
Write of size 4
Call Trace:
 memcpy
 ath9k_wmi_ctrl_rx
 ath9k_htc_rx_msg
 ath9k_hif_usb_reg_in_cb
 __usb_hcd_giveback_urb
 usb_hcd_giveback_urb
 dummy_timer
 call_timer_fn
 run_timer_softirq
 __do_softirq
 irq_exit_rcu
 sysvec_apic_timer_interrupt
References: https://git.kernel.org/stable/c/1af7eacfad45149c54893a8a9df9e92ef89f0a90; https://git.kernel.org/stable/c/554048a72d7ecfdd58cc1bfb56e0a1864e64e82c; https://git.kernel.org/stable/c/78b56b0a613a87b61290b95be497fdfe2fe58aa6
CVE: CVE-2023-53719
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

serial: arc_uart: fix of_iomap leak in `arc_serial_probe`

Smatch reports:

drivers/tty/serial/arc_uart.c:631 arc_serial_probe() warn:
'port->membase' from of_iomap() not released on lines: 631.

In arc_serial_probe(), if uart_add_one_port() fails,
port->membase is not released, which would cause a resource leak.

To fix this, I replace of_iomap with devm_platform_ioremap_resource.
References: https://git.kernel.org/stable/c/081790eee6b47389a0d895262086d64c6a38d6e5; https://git.kernel.org/stable/c/153017561d2804cfae87cc9aa377aa84dd906ae1; https://git.kernel.org/stable/c/3f00df24a5021a6f02c1830a290acd4bceb22a2d
CVE: CVE-2023-53720
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Release the label when replacing existing ct entry

Cited commit doesn't release the label mapping when replacing existing ct
entry which leads to following memleak report:

unreferenced object 0xffff8881854cf280 (size 96):
  comm "kworker/u48:74", pid 23093, jiffies[PII_REDACTED] (age 175.944s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<[PII_REDACTED]22d368>] __kmalloc+0x4b/0x1c0
    [<00000000cc44e18f>] mapping_add+0x6e8/0xc90 [mlx5_core]
    [<000000003ad942a7>] mlx5_get_label_mapping+0x66/0xe0 [mlx5_core]
    [<[PII_REDACTED]6308ac>] mlx5_tc_ct_entry_create_mod_hdr+0x1c4/0xf50 [mlx5_core]
    [<000000009a768b4f>] mlx5_tc_ct_entry_add_rule+0x16f/0xaf0 [mlx5_core]
    [<00000000a178f3e5>] mlx5_tc_ct_block_flow_offload_add+0x10cb/0x1f90 [mlx5_core]
    [<000000007b46c496>] mlx5_tc_ct_block_flow_offload+0x14a/0x630 [mlx5_core]
    [<00000000a9a18ac5>] nf_flow_offload_tuple+0x1a3/0x390 [nf_flow_table]
    [<00000000d0881951>] flow_offload_work_handler+0x257/0xd30 [nf_flow_table]
    [<000000009e4935a4>] process_one_work+0x7c2/0x13e0
    [<00000000f5cd36a7>] worker_thread+0x59d/0xec0
    [<00000000baed1daf>] kthread+0x28f/0x330
    [<[PII_REDACTED]d282a4>] ret_from_fork+0x1f/0x30

Fix the issue by correctly releasing the label mapping.
References: https://git.kernel.org/stable/c/3db903a71f1f4bbf30baae166a4a49f2e8aceb61; https://git.kernel.org/stable/c/8ac04a28144cfa89b61be[PII_REDACTED]42c23d88d
CVE: CVE-2023-53721
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: Fix a NULL pointer dereference in ath12k_mac_op_hw_scan()

In ath12k_mac_op_hw_scan(), the return value of kzalloc() is directly
used in memcpy(), which may lead to a NULL pointer dereference on
failure of kzalloc().

Fix this bug by adding a check of arg.extraie.ptr.

Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4
References: https://git.kernel.org/stable/c/5a263df398b581189fe632b4ab8440f3dd76c251; https://git.kernel.org/stable/c/8ad314da54c6dd223a6b6cc85019160aa842f659
CVE: CVE-2023-53722
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

md: raid1: fix potential OOB in raid1_remove_disk()

If rddev->raid_disk is greater than mddev->raid_disks, there will be
an out-of-bounds in raid1_remove_disk(). We have already found
similar reports as follows:

1) commit d17f744e883b ("md-raid10: fix KASAN warning")
2) commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5_remove_disk")

Fix this bug by checking whether the "number" variable is
valid.
References: https://git.kernel.org/stable/c/25a68f2286be56fb3a6f9fa0e269c04b5e6c6e24; https://git.kernel.org/stable/c/4bdb92eaf645e312975357adc3c4e9523b6e67f1; https://git.kernel.org/stable/c/4f7d853b4590fc20e90dd50e346c02811a8c5b08
CVE: CVE-2023-53723
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspend

sdma_v4_0_ip is shared on a few asics, but in sdma_v4_0_hw_fini,
driver unconditionally disables ecc_irq which is only enabled on
those asics enabling sdma ecc. This will introduce a warning in
suspend cycle on those chips with sdma ip v4.0, while without
sdma ecc. So this patch correct this.

[ 7283.166354] RIP: 0010:amdgpu_irq_put+0x45/0x70 [amdgpu]
[ 7283.167001] RSP: 0018:ffff9a5fc3967d08 EFLAGS: 00010246
[ 7283.167019] RAX: ffff98d88afd3770 RBX: [PII_REDACTED] RCX: [PII_REDACTED]
[ 7283.167023] RDX: [PII_REDACTED] RSI: ffff98d89da30390 RDI: ffff98d89da20000
[ 7283.167025] RBP: ffff98d89da20000 R08: [PII_REDACTED] R09: [PII_REDACTED]
[ 7283.167028] R10: ffffd5764243c008 R11: [PII_REDACTED] R12: ffff98d89da30390
[ 7283.167030] R13: ffff98d89da38978 R14: ffffffff999ae15a R15: ffff98d880130105
[ 7283.167032] FS:  [PII_REDACTED](0000) GS:ffff98d996f00000(0000) knlGS:[PII_REDACTED]
[ 7283.167036] CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
[ 7283.167039] CR2: 00000000f7a9d178 CR3: 00000001c42ea000 CR4:[PII_REDACTED]3506e0
[ 7283.167041] Call Trace:
[ 7283.167046]  <TASK>
[ 7283.167048]  sdma_v4_0_hw_fini+0x38/0xa0 [amdgpu]
[ 7283.167704]  amdgpu_device_ip_suspend_phase2+0x101/0x1a0 [amdgpu]
[ 7283.168296]  amdgpu_device_suspend+0x103/0x180 [amdgpu]
[ 7283.168875]  amdgpu_pmops_freeze+0x21/0x60 [amdgpu]
[ 7283.169464]  pci_pm_freeze+0x54/0xc0
References: https://git.kernel.org/stable/c/2a179117a3b29e7136e4045c57090a05bb97f373; https://git.kernel.org/stable/c/3decf3a750a924362bf4e2680dd3b07242fe56e8; https://git.kernel.org/stable/c/71e1f44077db83e205db70a684c1f2c5d2247174
CVE: CVE-2023-53724
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()

`req` is allocated in pcf50633_adc_async_read(), but
adc_enqueue_request() could fail to insert the `req` into queue.
We need to check the return value and free it in the case of failure.
References: https://git.kernel.org/stable/c/3ee13bdf0d25ae8752ae6185b6d13bbb0d5a8e30; https://git.kernel.org/stable/c/41cdf082ae006ea002135dfaf43b2897de3bded8; https://git.kernel.org/stable/c/588edb4fb1f1e6487a0f60a5f7b9a24d2d0c9f8e
CVE: CVE-2023-53725
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe

Smatch reports:
drivers/clocksource/timer-cadence-ttc.c:529 ttc_timer_probe()
warn: 'timer_baseaddr' from of_iomap() not released on lines: 498,508,516.

timer_baseaddr may have the problem of not being released after use,
I replaced it with the devm_of_iomap() function and added the clk_put()
function to cleanup the "clk_ce" and "clk_cs".
References: https://git.kernel.org/stable/c/289e2054eeb63c9e133960731c342eeffad218d3; https://git.kernel.org/stable/c/54cc10a0f4b01b522e[PII_REDACTED]f1b33bf7e4aa; https://git.kernel.org/stable/c/67d7eebbc424935dec61fb352d1ccae5d16cf429
CVE: CVE-2023-53726
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

arm64: csum: Fix OoB access in IP checksum code for negative lengths

Although commit c2c24edb1d9c ("arm64: csum: Fix pathological zero-length
calls") added an early return for zero-length input, syzkaller has
popped up with an example of a _negative_ length which causes an
undefined shift and an out-of-bounds read:

 | BUG: KASAN: slab-out-of-bounds in do_csum+0x44/0x254 arch/arm64/lib/csum.c:39
 | Read of size[PII_REDACTED] at addr ffff0000d7ac0170 by task syz-executor412/5975
 |
 | CPU: 0 PID: 5975 Comm: syz-executor412 Not tainted 6.4.0-rc4-syzkaller-g908f31f2a05b #0
 | Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
 | Call trace:
 |  dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:233
 |  show_stack+0x2c/0x44 arch/arm64/kernel/stacktrace.c:240
 |  __dump_stack lib/dump_stack.c:88 [inline]
 |  dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106
 |  print_address_description mm/kasan/report.c:351 [inline]
 |  print_report+0x174/0x514 mm/kasan/report.c:462
 |  kasan_report+0xd4/0x130 mm/kasan/report.c:572
 |  kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:187
 |  __kasan_check_read+0x20/0x30 mm/kasan/shadow.c:31
 |  do_csum+0x44/0x254 arch/arm64/lib/csum.c:39
 |  csum_partial+0x30/0x58 lib/checksum.c:128
 |  gso_make_checksum include/linux/skbuff.h:4928 [inline]
 |  __udp_gso_segment+0xaf4/0x1bc4 net/ipv4/udp_offload.c:332
 |  udp6_ufo_fragment+0x540/0xca0 net/ipv6/udp_offload.c:47
 |  ipv6_gso_segment+0x5cc/0x1760 net/ipv6/ip6_offload.c:119
 |  skb_mac_gso_segment+0x2b4/0x5b0 net/core/gro.c:141
 |  __skb_gso_segment+0x250/0x3d0 net/core/dev.c:3401
 |  skb_gso_segment include/linux/netdevice.h:4859 [inline]
 |  validate_xmit_skb+0x364/0xdbc net/core/dev.c:3659
 |  validate_xmit_skb_list+0x94/0x130 net/core/dev.c:3709
 |  sch_direct_xmit+0xe8/0x548 net/sched/sch_generic.c:327
 |  __dev_xmit_skb net/core/dev.c:3805 [inline]
 |  __dev_queue_xmit+0x147c/0x3318 net/core/dev.c:4210
 |  dev_queue_xmit include/linux/netdevice.h:3085 [inline]
 |  packet_xmit+0x6c/0x318 net/packet/af_packet.c:276
 |  packet_snd net/packet/af_packet.c:3081 [inline]
 |  packet_sendmsg+0x376c/0x4c98 net/packet/af_packet.c:3113
 |  sock_sendmsg_nosec net/socket.c:724 [inline]
 |  sock_sendmsg net/socket.c:747 [inline]
 |  __sys_sendto+0x3b4/0x538 net/socket.c:2144

Extend the early return to reject negative lengths as well, aligning our
implementation with the generic code in lib/checksum.c
References: https://git.kernel.org/stable/c/5a85727239a23de1cc8d93985f[PII_REDACTED]f3e2; https://git.kernel.org/stable/c/8bd795fedb8450ecbef18eeadbd23ed8fc7630f5; https://git.kernel.org/stable/c/9a43563cfd6b9200ff2f76b3f9fcdcb217ceb523
CVE: CVE-2023-53727
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

net/sched: fq_pie: avoid stalls in fq_pie_timer()

When setting a high number of flows (limit being 65536),
fq_pie_timer() is currently using too much time as syzbot reported.

Add logic to yield the cpu every 2048 flows (less than 150 usec
on debug kernels).
It should also help by not blocking qdisc fast paths for too long.
Worst case (65536 flows) would need 31 jiffies for a complete scan.

Relevant extract from syzbot report:

rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 0-.... } 2663 jiffies s: 873 root: 0x1/.
rcu: blocking rcu_node structures (internal RCU debug):
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 5177 Comm: syz-executor273 Not tainted 6.5.0-syzkaller-00453-g727dbda16b83 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
RIP: 0010:check_kcov_mode kernel/kcov.c:173 [inline]
RIP: 0010:write_comp_data+0x21/0x90 kernel/kcov.c:236
Code: 2e 0f 1f 84 00 00 00 00 00 65 8b 05 01 b2 7d 7e 49 89 f1 89 c6 49 89 d2 81 e6 00 01 00 00 49 89 f8 65 48 8b 14 25 80 b9 03 00 <a9> 00 01 ff 00 74 0e 85 f6 74 59 8b 82 04 16 00 00 85 c0 74 4f 8b
RSP: 0018:ffffc90000007bb8 EFLAGS: 00000206
RAX: [PII_REDACTED] RBX: ffffc9000dc0d140 RCX: ffffffff885893b0
RDX: ffff88807c075940 RSI: [PII_REDACTED] RDI: [PII_REDACTED]
RBP: [PII_REDACTED] R08: [PII_REDACTED] R09: [PII_REDACTED]
R10: [PII_REDACTED] R11: [PII_REDACTED] R12: ffffc9000dc0d178
R13: [PII_REDACTED] R14: [PII_REDACTED] R15: [PII_REDACTED]
FS: [PII_REDACTED]d54380(0000) GS:ffff8880b9800000(0000) knlGS:[PII_REDACTED]
CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
CR2: 00007f6b442f6130 CR3: 000000006fe1c000 CR4:[PII_REDACTED]3506f0
DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2: [PII_REDACTED]
DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7: [PII_REDACTED]
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 pie_calculate_probability+0x480/0x850 net/sched/sch_pie.c:415
 fq_pie_timer+0x1da/0x4f0 net/sched/sch_fq_pie.c:387
 call_timer_fn+0x1a0/0x580 kernel/time/timer.c:1700
References: https://git.kernel.org/stable/c/8c21ab1bae945686c602c5bfa4e3f3352c2452c5; https://git.kernel.org/stable/c/94d527c3759d76c[PII_REDACTED]2f622954612bea7; https://git.kernel.org/stable/c/973a4c302d7f3804098ff9824d9f56926901f293
CVE: CVE-2023-53728
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

posix-timers: Ensure timer ID search-loop limit is valid

posix_timer_add() tries to allocate a posix timer ID by starting from the
cached ID which was stored by the last successful allocation.

This is done in a loop searching the ID space for a free slot one by
one. The loop has to terminate when the search wrapped around to the
starting point.

But that's racy vs. establishing the starting point. That is read out
lockless, which leads to the following problem:

CPU0	  	      	     	   CPU1
posix_timer_add()
  start = sig->posix_timer_id;
  lock(hash_lock);
  ...				   posix_timer_add()
  if (++sig->posix_timer_id < 0)
      			             start = sig->posix_timer_id;
     sig->posix_timer_id = 0;

So CPU1 can observe a negative start value, i.e. -1, and the loop break
never happens because the condition can never be true:

  if (sig->posix_timer_id == start)
     break;

While this is unlikely to ever turn into an endless loop as the ID space is
huge (INT_MAX), the racy read of the start value caught the attention of
KCSAN and Dmitry unearthed that incorrectness.

Rewrite it so that all id operations are under the hash lock.
References: https://git.kernel.org/stable/c/322377cc909defcca[PII_REDACTED]845e7e1d20d1b; https://git.kernel.org/stable/c/37175e25edf7cc0d5a2cd2c2a1cbe2dcbf4a1937; https://git.kernel.org/stable/c/6a0ac84501b4fec73a1a823c55cf13584c43f418
CVE: CVE-2023-53729
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

soc: qcom: qmi_encdec: Restrict string length in decode

The QMI TLV value for strings in a lot of qmi element info structures
account for null terminated strings with MAX_LEN + 1. If a string is
actually MAX_LEN + 1 length, this will cause an out of bounds access
when the NULL character is appended in decoding.
References: https://git.kernel.org/stable/c/22ee7c9c7f381be178b4457bc54530002e08e938; https://git.kernel.org/stable/c/2ccab9f82772ead618689d17dbc6950d6bd1e741; https://git.kernel.org/stable/c/64c5e916fabe5ef7bef0210b8a59fa8941ee1b8e
CVE: CVE-2023-53731
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

netlink: fix potential deadlock in netlink_set_err()

syzbot reported a possible deadlock in netlink_set_err() [1]

A similar issue was fixed in commit 1d482e666b8e ("netlink: disable IRQs
for netlink_lock_table()") in netlink_lock_table()

This patch adds IRQ safety to netlink_set_err() and __netlink_diag_dump()
which were not covered by cited commit.

[1]

WARNING: possible irq lock inversion dependency detected
6.4.0-rc6-syzkaller-00240-g4e9f0ec38852 #0 Not tainted

syz-executor.2/23011 just changed the state of lock:
ffffffff8e1a7a58 (nl_table_lock){.+.?}-{2:2}, at: netlink_set_err+0x2e/0x3a0 net/netlink/af_netlink.c:1612
but this lock was taken by another, SOFTIRQ-safe lock in the past:
 (&local->queue_stop_reason_lock){..-.}-{2:2}

and interrupts could create inverse lock ordering between them.

other info that might help us debug this:
 Possible interrupt unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(nl_table_lock);
                               local_irq_disable();
                               lock(&local->queue_stop_reason_lock);
                               lock(nl_table_lock);
  <Interrupt>
    lock(&local->queue_stop_reason_lock);

 *** DEADLOCK ***
References: https://git.kernel.org/stable/c/1556ba034b95cfd4f75ea93c1a2679ae0444bba1; https://git.kernel.org/stable/c/4b9adb8d4a62ff7608d4a7d4eb42036a88f30980; https://git.kernel.org/stable/c/61ffe8b1ee084e5c82a4e4bbf9e7b68e0c06e464
CVE: CVE-2023-53732
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Fix NULL dereference in ni_write_inode

Syzbot reports a NULL dereference in ni_write_inode.
When creating a new inode, if allocation fails in mi_init function
(called in mi_format_new function), mi->mrec is set to NULL.
In the error path of this inode creation, mi->mrec is later
dereferenced in ni_write_inode.

Add a NULL check to prevent NULL dereference.
References: https://git.kernel.org/stable/c/8dae4f6341e335a09575be60b4fdf697c732a470; https://git.kernel.org/stable/c/b1135fbaf8ebef93df326761ac70ebcc3c2e3d63; https://git.kernel.org/stable/c/b3152afc0eb864f7c6ecad134a15b577ef7aec77
CVE: CVE-2025-11750
Published: 2025-10-22
Description: In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or registration attempt is made with a non-existent username or email, the system responds with a message such as "account not found." Conversely, when the username or email exists but the password is incorrect, a different error message is returned. This discrepancy allows an attacker to enumerate valid user accounts by analyzing the error responses, potentially facilitating targeted social engineering, brute force, or credential stuffing attacks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-544
References: https://huntr.com/bounties/e7359f9f-c004-4304-9de9-753622d370a1; https://huntr.com/bounties/e7359f9f-c004-4304-9de9-753622d370a1
CVE: CVE-2025-11844
Published: 2025-10-22
Description: Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitization or escaping. This allows an attacker to inject malicious XPath syntax that can alter the intended query logic. The vulnerability enables attackers to bypass search filters, access unintended DOM elements, and disrupt web automation workflows. This can lead to information disclosure, manipulation of AI agent interactions, and compromise the reliability of automated web tasks. The issue is fixed in version 1.22.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-643
References: https://github.com/huggingface/smolagents/commit/f570ed5e17999d4cf7d5e79c2830fbaefab8a794; https://huntr.com/bounties/01ab4405-9bca-4b26-b7a3-5ca1863a69b4; https://huntr.com/bounties/01ab4405-9bca-4b26-b7a3-5ca1863a69b4
CVE: CVE-2025-56447
Published: 2025-10-22
Description: TM2 Monitoring v3.04 contains an authentication bypass and plaintext credential disclosure.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-319
References: http://rt.com; http://tm2.com; https://gist.github.com/stSLAYER/b0be1f0fe95f56c08ef2bd69f40cd817
CVE: CVE-2025-61035
Published: 2025-10-22
Description: The seffaflik thru 0.0.9 is vulnerable to symlink attacks due to incorrect default permissions given to the .kimlik file and .seffaflik file, which is created with mode 0777 and 0775 respectively, exposing secrets to other local users. Additionally, the .kimlik file is written without symlink checks, allowing local attackers to overwrite arbitrary files. This can result in information disclosure and denial of service.
CVSS Score: 7.7 (HIGH)
CWE: CWE-276
References: https://github.com/nurisensoy/seffaflik; https://github.com/nurisensoy/seffaflik/issues/3; https://pypi.org/project/seffaflik/
CVE: CVE-2025-8848
Published: 2025-10-22
Description: A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET request with a crafted Accept-Language header, arbitrary HTML can be injected into the <html lang=""> tag of the response. This can lead to potential security risks such as cross-site scripting (XSS) attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-94, CWE-79
References: https://huntr.com/bounties/a05ebc1f-882a-4adc-b178-d3cefa4b730e
CVE: CVE-2016-15048
Published: 2025-10-22
Description: AMTT Hotel Broadband Operation System (HiBOS) contains an unauthenticated command injection vulnerability in the /manager/radius/server_ping.php endpoint. The application constructs a shell command that includes the user-supplied ip parameter and executes it without proper validation or escaping. An attacker can insert shell metacharacters into the ip parameter to inject and execute arbitrary system commands as the web server user. The initial third-party disclosure in 2016 recommended contacting the vendor for remediation guidance. Additionally, this product may have been rebranded under a different name. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-14 at 04:45:53.510819 UTC.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/adysec/nuclei_poc/blob/49c283b2bbb244c071786a2b768fbdde1b91f38e/poc/remote_code_execution/hiboss-rce_2.yaml#L21; https://wooyun.laolisafe.com/bug_detail.php?wybug_id=wooyun-2[PII_REDACTED]; https://www.amttgroup.com/
CVE: CVE-2025-11965
Published: 2025-10-22
Description: In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler configuration for restricting access to hidden files fails to restrict access to hidden directories, allowing unauthorized users to retrieve files within them (e.g. '.git/config').
CVSS Score: 7.5 (HIGH)
CWE: CWE-552
References: https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/304
CVE: CVE-2025-11966
Published: 2025-10-22
Description: In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted into generated HTML without proper escaping in the href, title, and link attributes. An attacker who can create or rename files or directories within a served path can craft filenames containing malicious script or HTML content, leading to stored cross-site scripting (XSS) that executes in the context of users viewing the affected directory listing.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-80
References: https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/303
CVE: CVE-2025-30944
Published: 2025-10-22
Description: Missing Authorization vulnerability in Essekia Tablesome Table Premium tablesome-premium allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Tablesome Table Premium: from n/a through <= 1.1.23.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/tablesome-premium/vulnerability/wordpress-tablesome-table-premium-1-1-23-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31634
Published: 2025-10-22
Description: Deserialization of Untrusted Data vulnerability in designthemes Insurance insurance allows Object Injection.This issue affects Insurance: from n/a through <= 3.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Theme/insurance/vulnerability/wordpress-insurance-3-5-php-object-injection-vulnerability?_s_id=cve