xamxte/cve-to-cwe huggingface dataset:
CVE-2023-53606: In the Linux kernel, the following vulnerability has been resolved:  nfsd: clean up potential nfsd_file refcount leaks in COPY codepath  There are two different flavors of the nfsd4_copy struct. One is embedded in the compound and is used directly in synchronous copies. The other is dynamically allocated, refcounted and tracked in the client struture. For the embedded one, the cleanup just involves releasing any nfsd_files held on its behalf. For the async one, the cleanup is a bit more involved, and we need to dequeue it from lists, unhash it, etc.  There is at least one potential refcount leak in this code now. If the kthread_create call fails, then both the src and dst nfsd_files in the original nfsd4_copy object are leaked.  The cleanup in this codepath is also sort of weird. In the async copy case, we'll have up to four nfsd_file references (src and dst for both flavors of copy structure). They are both put at the end of nfsd4_do_async_copy, even though the ones held on behalf of the embedded one outlive that structure.  Change it so that we always clean up the nfsd_file refs held by the embedded copy structure before nfsd4_copy returns. Rework cleanup_async_copy to handle both inter and intra copies. Eliminate nfsd4_cleanup_intra_ssc since it now becomes a no-op.
CVE-2023-53609: In the Linux kernel, the following vulnerability has been resolved:  scsi: Revert "scsi: core: Do not increase scsi_device's iorequest_cnt if dispatch failed"  The "atomic_inc(&cmd->device->iorequest_cnt)" in scsi_queue_rq() would cause kernel panic because cmd->device may be freed after returning from scsi_dispatch_cmd().  This reverts commit cfee29ffb45b1c9798011b19d454637d1b0fe87d.
CVE-2023-53610: In the Linux kernel, the following vulnerability has been resolved:  irqchip: Fix refcount leak in platform_irqchip_probe  of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.
CVE-2025-9703: The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) WordPress plugin before 2.5.0 does not sanitize SVG file contents when uploaded through the xmlrpc.php endpoint using base64 encode, leading to a Cross-Site Scripting vulnerability.
CVE-2025-9710: The Responsive Lightbox & Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modifications, potentially allowing unauthenticated attackers to abuse the functionality to include event handlers and conduct Stored XSS attacks.
CVE-2025-10162: The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin before 14 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files via a path traversal attack
CVE-2022-50511: In the Linux kernel, the following vulnerability has been resolved:  lib/fonts: fix undefined behavior in bit shift for get_default_font  Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned.  The UBSAN warning calltrace like below:  UBSAN: shift-out-of-bounds in lib/fonts/fonts.c:139:20 left shift of 1 by 31 places cannot be represented in type 'int'  <TASK>  dump_stack_lvl+0x7d/0xa5  dump_stack+0x15/0x1b  ubsan_epilogue+0xe/0x4e  __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c  get_default_font+0x1c7/0x1f0  fbcon_startup+0x347/0x3a0  do_take_over_console+0xce/0x270  do_fbcon_takeover+0xa1/0x170  do_fb_registered+0x2a8/0x340  fbcon_fb_registered+0x47/0xe0  register_framebuffer+0x294/0x4a0  __drm_fb_helper_initial_config_and_unlock+0x43c/0x880 [drm_kms_helper]  drm_fb_helper_initial_config+0x52/0x80 [drm_kms_helper]  drm_fbdev_client_hotplug+0x156/0x1b0 [drm_kms_helper]  drm_fbdev_generic_setup+0xfc/0x290 [drm_kms_helper]  bochs_pci_probe+0x6ca/0x772 [bochs]  local_pci_probe+0x4d/0xb0  pci_device_probe+0x119/0x320  really_probe+0x181/0x550  __driver_probe_device+0xc6/0x220  driver_probe_device+0x32/0x100  __driver_attach+0x195/0x200  bus_for_each_dev+0xbb/0x120  driver_attach+0x27/0x30  bus_add_driver+0x22e/0x2f0  driver_register+0xa9/0x190  __pci_register_driver+0x90/0xa0  bochs_pci_driver_init+0x52/0x1000 [bochs]  do_one_initcall+0x76/0x430  do_init_module+0x61/0x28a  load_module+0x1f82/0x2e50  __do_sys_finit_module+0xf8/0x190  __x64_sys_finit_module+0x23/0x30  do_syscall_64+0x58/0x80  entry_SYSCALL_64_after_hwframe+0x63/0xcd  </TASK>
CVE-2022-50514: In the Linux kernel, the following vulnerability has been resolved:  usb: gadget: f_hid: fix refcount leak on error path  When failing to allocate report_desc, opts->refcnt has already been incremented so it needs to be decremented to avoid leaving the options structure permanently locked.
CVE-2022-50520: In the Linux kernel, the following vulnerability has been resolved:  drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()  As comment of pci_get_class() says, it returns a pci_device with its refcount increased and decreased the refcount for the input parameter @from if it is not NULL.  If we break the loop in radeon_atrm_get_bios() with 'pdev' not NULL, we need to call pci_dev_put() to decrease the refcount. Add the missing pci_dev_put() to avoid refcount leak.
CVE-2022-50522: In the Linux kernel, the following vulnerability has been resolved:  mcb: mcb-parse: fix error handing in chameleon_parse_gdd()  If mcb_device_register() returns error in chameleon_parse_gdd(), the refcount of bus and device name are leaked. Fix this by calling put_device() to give up the reference, so they can be released in mcb_release_dev() and kobject_cleanup().
CVE-2022-50534: In the Linux kernel, the following vulnerability has been resolved:  dm thin: Use last transaction's pmd->root when commit failed  Recently we found a softlock up problem in dm thin pool btree lookup code due to corrupted metadata:   Kernel panic - not syncing: softlockup: hung tasks  CPU: 7 PID: 2669225 Comm: kworker/u16:3  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)  Workqueue: dm-thin do_worker [dm_thin_pool]  Call Trace:    <IRQ>    dump_stack+0x9c/0xd3    panic+0x35d/0x6b9    watchdog_timer_fn.cold+0x16/0x25    __run_hrtimer+0xa2/0x2d0    </IRQ>    RIP: 0010:__relink_lru+0x102/0x220 [dm_bufio]    __bufio_new+0x11f/0x4f0 [dm_bufio]    new_read+0xa3/0x1e0 [dm_bufio]    dm_bm_read_lock+0x33/0xd0 [dm_persistent_data]    ro_step+0x63/0x100 [dm_persistent_data]    btree_lookup_raw.constprop.0+0x44/0x220 [dm_persistent_data]    dm_btree_lookup+0x16f/0x210 [dm_persistent_data]    dm_thin_find_block+0x12c/0x210 [dm_thin_pool]    __process_bio_read_only+0xc5/0x400 [dm_thin_pool]    process_thin_deferred_bios+0x1a4/0x4a0 [dm_thin_pool]    process_one_work+0x3c5/0x730  Following process may generate a broken btree mixed with fresh and stale btree nodes, which could get dm thin trapped in an infinite loop while looking up data block:  Transaction 1: pmd->root = A, A->B->C   // One path in btree                 pmd->root = X, X->Y->Z   // Copy-up  Transaction 2: X,Z is updated on disk, Y write failed.                 // Commit failed, dm thin becomes read-only.                 process_bio_read_only    dm_thin_find_block     __find_block      dm_btree_lookup(pmd->root) The pmd->root points to a broken btree, Y may contain stale node pointing to any block, for example X, which gets dm thin trapped into a dead loop while looking up Z.  Fix this by setting pmd->root in __open_metadata(), so that dm thin will use the last transaction's pmd->root if commit failed.  Fetch a reproducer in [Link].  Linke: https://bugzilla.kernel.org/show_bug.cgi?id=216790
CVE-2022-50539: In the Linux kernel, the following vulnerability has been resolved:  ARM: OMAP2+: omap4-common: Fix refcount leak bug  In omap4_sram_init(), of_find_compatible_node() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore.
CVE-2022-50554: In the Linux kernel, the following vulnerability has been resolved:  blk-mq: avoid double ->queue_rq() because of early timeout  David Jeffery found one double ->queue_rq() issue, so far it can be triggered in VM use case because of long vmexit latency or preempt latency of vCPU pthread or long page fault in vCPU pthread, then block IO req could be timed out before queuing the request to hardware but after calling blk_mq_start_request() during ->queue_rq(), then timeout handler may handle it by requeue, then double ->queue_rq() is caused, and kernel panic.  So far, it is driver's responsibility to cover the race between timeout and completion, so it seems supposed to be solved in driver in theory, given driver has enough knowledge.  But it is really one common problem, lots of driver could have similar issue, and could be hard to fix all affected drivers, even it isn't easy for driver to handle the race. So David suggests this patch by draining in-progress ->queue_rq() for solving this issue.
CVE-2023-53618: In the Linux kernel, the following vulnerability has been resolved:  btrfs: reject invalid reloc tree root keys with stack dump  [BUG] Syzbot reported a crash that an ASSERT() got triggered inside prepare_to_merge().  That ASSERT() makes sure the reloc tree is properly pointed back by its subvolume tree.  [CAUSE] After more debugging output, it turns out we had an invalid reloc tree:    BTRFS error (device loop1): reloc tree mismatch, root 8 has no reloc root, expect reloc root key (-8, 132, 8) gen 17  Note the above root key is (TREE_RELOC_OBJECTID, ROOT_ITEM, QUOTA_TREE_OBJECTID), meaning it's a reloc tree for quota tree.  But reloc trees can only exist for subvolumes, as for non-subvolume trees, we just COW the involved tree block, no need to create a reloc tree since those tree blocks won't be shared with other trees.  Only subvolumes tree can share tree blocks with other trees (thus they have BTRFS_ROOT_SHAREABLE flag).  Thus this new debug output proves my previous assumption that corrupted on-disk data can trigger that ASSERT().  [FIX] Besides the dedicated fix and the graceful exit, also let tree-checker to check such root keys, to make sure reloc trees can only exist for subvolumes.
CVE-2023-53630: In the Linux kernel, the following vulnerability has been resolved:  iommufd: Fix unpinning of pages when an access is present  syzkaller found that the calculation of batch_last_index should use 'start_index' since at input to this function the batch is either empty or it has already been adjusted to cross any accesses so it will start at the point we are unmapping from.  Getting this wrong causes the unmap to run over the end of the pages which corrupts pages that were never mapped. In most cases this triggers the num pinned debugging:    WARNING: CPU: 0 PID: 557 at drivers/iommu/iommufd/pages.c:294 __iopt_area_unfill_domain+0x152/0x560   Modules linked in:   CPU: 0 PID: 557 Comm: repro Not tainted 6.3.0-rc2-eeac8ede1755 #1   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014   RIP: 0010:__iopt_area_unfill_domain+0x152/0x560   Code: d2 0f ff 44 8b 64 24 54 48 8b 44 24 48 31 ff 44 89 e6 48 89 44 24 38 e8 fc d3 0f ff 45 85 e4 0f 85 eb 01 00 00 e8 0e d2 0f ff <0f> 0b e8 07 d2 0f ff 48 8b 44 24 38 89 5c 24 58 89 18 8b 44 24 54   RSP: 0018:ffffc9000108baf0 EFLAGS: 00010246   RAX: 0000000000000000 RBX: 00000000ffffffff RCX: ffffffff821e3f85   RDX: 0000000000000000 RSI: ffff88800faf0000 RDI: 0000000000000002   RBP: ffffc9000108bd18 R08: 000000000003ca25 R09: 0000000000000014   R10: 000000000003ca00 R11: 0000000000000024 R12: 0000000000000004   R13: 0000000000000801 R14: 00000000000007ff R15: 0000000000000800   FS:  00007f3499ce1740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033   CR2: 0000000020000243 CR3: 00000000179c2001 CR4: 0000000000770ef0   PKRU: 55555554   Call Trace:    <TASK>    iopt_area_unfill_domain+0x32/0x40    iopt_table_remove_domain+0x23f/0x4c0    iommufd_device_selftest_detach+0x3a/0x90    iommufd_selftest_destroy+0x55/0x70    iommufd_object_destroy_user+0xce/0x130    iommufd_destroy+0xa2/0xc0    iommufd_fops_ioctl+0x206/0x330    __x64_sys_ioctl+0x10e/0x160    do_syscall_64+0x3b/0x90    entry_SYSCALL_64_after_hwframe+0x72/0xdc  Also add some useful WARN_ON sanity checks.
CVE-2023-53631: In the Linux kernel, the following vulnerability has been resolved:  platform/x86: dell-sysman: Fix reference leak  If a duplicate attribute is found using kset_find_obj(), a reference to that attribute is returned. This means that we need to dispose it accordingly. Use kobject_put() to dispose the duplicate attribute in such a case.  Compile-tested only.
CVE-2023-53644: In the Linux kernel, the following vulnerability has been resolved:  media: radio-shark: Add endpoint checks  The syzbot fuzzer was able to provoke a WARNING from the radio-shark2 driver:  ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 0 PID: 3271 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed2/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 3271 Comm: kworker/0:3 Not tainted 6.1.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_submit_urb+0xed2/0x1880 drivers/usb/core/urb.c:504 Code: 7c 24 18 e8 00 36 ea fb 48 8b 7c 24 18 e8 36 1c 02 ff 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 a0 b6 90 8a e8 9a 29 b8 03 <0f> 0b e9 58 f8 ff ff e8 d2 35 ea fb 48 81 c5 c0 05 00 00 e9 84 f7 RSP: 0018:ffffc90003876dd0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 RDX: ffff8880750b0040 RSI: ffffffff816152b8 RDI: fffff5200070edac RBP: ffff8880172d81e0 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000000 R11: 0000000000000000 R12: 0000000000000001 R13: ffff8880285c5040 R14: 0000000000000002 R15: ffff888017158200 FS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe03235b90 CR3: 000000000bc8e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace:  <TASK>  usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58  usb_bulk_msg+0x226/0x550 drivers/usb/core/message.c:387  shark_write_reg+0x1ff/0x2e0 drivers/media/radio/radio-shark2.c:88 ...  The problem was caused by the fact that the driver does not check whether the endpoints it uses are actually present and have the appropriate types.  This can be fixed by adding a simple check of these endpoints (and similarly for the radio-shark driver).
CVE-2023-53651: In the Linux kernel, the following vulnerability has been resolved:  Input: exc3000 - properly stop timer on shutdown  We need to stop the timer on driver unbind or probe failures, otherwise we get UAF/Oops.
CVE-2023-53663: In the Linux kernel, the following vulnerability has been resolved:  KVM: nSVM: Check instead of asserting on nested TSC scaling support  Check for nested TSC scaling support on nested SVM VMRUN instead of asserting that TSC scaling is exposed to L1 if L1's MSR_AMD64_TSC_RATIO has diverged from KVM's default.  Userspace can trigger the WARN at will by writing the MSR and then updating guest CPUID to hide the feature (modifying guest CPUID is allowed anytime before KVM_RUN).  E.g. hacking KVM's state_test selftest to do    vcpu_set_msr(vcpu, MSR_AMD64_TSC_RATIO, 0);   vcpu_clear_cpuid_feature(vcpu, X86_FEATURE_TSCRATEMSR);  after restoring state in a new VM+vCPU yields an endless supply of:    ------------[ cut here ]------------   WARNING: CPU: 164 PID: 62565 at arch/x86/kvm/svm/nested.c:699            nested_vmcb02_prepare_control+0x3d6/0x3f0 [kvm_amd]   Call Trace:    <TASK>    enter_svm_guest_mode+0x114/0x560 [kvm_amd]    nested_svm_vmrun+0x260/0x330 [kvm_amd]    vmrun_interception+0x29/0x30 [kvm_amd]    svm_invoke_exit_handler+0x35/0x100 [kvm_amd]    svm_handle_exit+0xe7/0x180 [kvm_amd]    kvm_arch_vcpu_ioctl_run+0x1eab/0x2570 [kvm]    kvm_vcpu_ioctl+0x4c9/0x5b0 [kvm]    __se_sys_ioctl+0x7a/0xc0    __x64_sys_ioctl+0x21/0x30    do_syscall_64+0x41/0x90    entry_SYSCALL_64_after_hwframe+0x63/0xcd   RIP: 0033:0x45ca1b  Note, the nested #VMEXIT path has the same flaw, but needs a different fix and will be handled separately.
CVE-2023-53665: In the Linux kernel, the following vulnerability has been resolved:  md: don't dereference mddev after export_rdev()  Except for initial reference, mddev->kobject is referenced by rdev->kobject, and if the last rdev is freed, there is no guarantee that mddev is still valid. Hence mddev should not be used anymore after export_rdev().  This problem can be triggered by following test for mdadm at very low rate:  New file: mdadm/tests/23rdev-lifetime  devname=${dev0##*/} devt=`cat /sys/block/$devname/dev` pid="" runtime=2  clean_up_test() {         pill -9 $pid         echo clear > /sys/block/md0/md/array_state }  trap 'clean_up_test' EXIT  add_by_sysfs() {         while true; do                 echo $devt > /sys/block/md0/md/new_dev         done }  remove_by_sysfs(){         while true; do                 echo remove > /sys/block/md0/md/dev-${devname}/state         done }  echo md0 > /sys/module/md_mod/parameters/new_array || die "create md0 failed"  add_by_sysfs & pid="$pid $!"  remove_by_sysfs & pid="$pid $!"  sleep $runtime exit 0  Test cmd:  ./test --save-logs --logdir=/tmp/ --keep-going --dev=loop --tests=23rdev-lifetime  Test result:  general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6bcb: 0000 [#4] PREEMPT SMP CPU: 0 PID: 1292 Comm: test Tainted: G      D W          6.5.0-rc2-00121-g01e55c376936 #562 RIP: 0010:md_wakeup_thread+0x9e/0x320 [md_mod] Call Trace:  <TASK>  mddev_unlock+0x1b6/0x310 [md_mod]  rdev_attr_store+0xec/0x190 [md_mod]  sysfs_kf_write+0x52/0x70  kernfs_fop_write_iter+0x19a/0x2a0  vfs_write+0x3b5/0x770  ksys_write+0x74/0x150  __x64_sys_write+0x22/0x30  do_syscall_64+0x40/0x90  entry_SYSCALL_64_after_hwframe+0x63/0xcd  Fix this problem by don't dereference mddev after export_rdev().
CVE-2023-53666: In the Linux kernel, the following vulnerability has been resolved:  ASoC: codecs: wcd938x: fix missing mbhc init error handling  MBHC initialisation can fail so add the missing error handling to avoid dereferencing an error pointer when later configuring the jack:      Unable to handle kernel paging request at virtual address fffffffffffffff8      pc : wcd_mbhc_start+0x28/0x380 [snd_soc_wcd_mbhc]     lr : wcd938x_codec_set_jack+0x28/0x48 [snd_soc_wcd938x]      Call trace:      wcd_mbhc_start+0x28/0x380 [snd_soc_wcd_mbhc]      wcd938x_codec_set_jack+0x28/0x48 [snd_soc_wcd938x]      snd_soc_component_set_jack+0x28/0x8c [snd_soc_core]      qcom_snd_wcd_jack_setup+0x7c/0x19c [snd_soc_qcom_common]      sc8280xp_snd_init+0x20/0x2c [snd_soc_sc8280xp]      snd_soc_link_init+0x28/0x90 [snd_soc_core]      snd_soc_bind_card+0x628/0xbfc [snd_soc_core]      snd_soc_register_card+0xec/0x104 [snd_soc_core]      devm_snd_soc_register_card+0x4c/0xa4 [snd_soc_core]      sc8280xp_platform_probe+0xf0/0x108 [snd_soc_sc8280xp]
CVE-2023-53684: In the Linux kernel, the following vulnerability has been resolved:  xfrm: Zero padding when dumping algos and encap  When copying data to user-space we should ensure that only valid data is copied over.  Padding in structures may be filled with random (possibly sensitve) data and should never be given directly to user-space.  This patch fixes the copying of xfrm algorithms and the encap template in xfrm_user so that padding is zeroed.
CVE-2025-10635: The Find Me On WordPress plugin through 2.0.9.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers and above to perform SQL injection attacks
CVE-2025-39960: In the Linux kernel, the following vulnerability has been resolved:  gpiolib: acpi: initialize acpi_gpio_info struct  Since commit 7c010d463372 ("gpiolib: acpi: Make sure we fill struct acpi_gpio_info"), uninitialized acpi_gpio_info struct are passed to __acpi_find_gpio() and later in the call stack info->quirks is used in acpi_populate_gpio_lookup. This breaks the i2c_hid_cpi driver:  [   58.122916] i2c_hid_acpi i2c-UNIW0001:00: HID over i2c has not been provided an Int IRQ [   58.123097] i2c_hid_acpi i2c-UNIW0001:00: probe with driver i2c_hid_acpi failed with error -22  Fix this by initializing the acpi_gpio_info pass to __acpi_find_gpio()
CVE-2025-10124: The Booking Manager  WordPress plugin before 2.1.15 registers a shortcode that deletes bookings and makes that shortcode available to anyone with contributor and above privileges. When a page containing the shortcode is visited, the bookings are deleted.
CVE-2025-21046: Improper access control in WindowManager in Samsung DeX prior to SMR Oct-2025 Release 1 allows physical attackers to temporarily access to recent app list.
CVE-2025-21047: Improper access control in KnoxGuard prior to SMR Oct-2025 Release 1 allows physical attackers to use the privileged APIs.
CVE-2025-21049: Improper access control in SecSettings prior to SMR Oct-2025 Release 1 allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability.
CVE-2025-21050: Improper input validiation in Contacts prior to SMR Oct-2025 Release 1 allows local attackers to access data across multiple user profiles.
CVE-2025-21058: Improper access control in Routines prior to version 4.8.7.1 in Android 15 and 4.9.6.0 in Android 16 allows local attackers to potentially execute arbitrary code with SystemUI privilege.
CVE-2025-21059: Improper authorization in Samsung Health prior to version 6.30.5.105 allows local attackers to access data in Samsung Health.
CVE-2025-21063: Improper access control in Samsung Voice Recorder prior to version 21.5.73.12 in Android 15 and 21.5.81.40 in Android 16 allows physical attackers to access recording files on the lock screen.
CVE-2025-21064: Improper authentication in Smart Switch prior to version 3.7.66.6 allows adjacent attackers to access transferring data.
CVE-2025-21065: Improper input validation in Retail Mode prior to version 5.59.11 allows self attackers to execute privileged commands on their own devices.
CVE-2025-31717: In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed.
CVE-2025-31718: In modem, there is a possible system crash due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed.
CVE-2025-9698: The Plus Addons for Elementor  WordPress plugin before 6.3.16 does not sanitize SVG file contents, which could allow users with minimum role access as Author to perform Stored Cross-Site Scripting attacks.
CVE-2025-10720: The WP Private Content Plus through 3.6.2 provides a global content protection feature that requires a password. However, the access control check is based only on the presence of an unprotected client-side cookie. As a result, an unauthenticated attacker can completely bypass the password protection by manually setting the cookie value in their browser.
CVE-2025-39964: In the Linux kernel, the following vulnerability has been resolved:  crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg  Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion.  Furthermore, concurrent writes may create inconsistencies in the internal socket state.  Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.
CVE-2025-39965: In the Linux kernel, the following vulnerability has been resolved:  xfrm: xfrm_alloc_spi shouldn't use 0 as SPI  x->id.spi == 0 means "no SPI assigned", but since commit 94f39804d891 ("xfrm: Duplicate SPI Handling"), we now create states and add them to the byspi list with this value.  __xfrm_state_delete doesn't remove those states from the byspi list, since they shouldn't be there, and this shows up as a UAF the next time we go through the byspi list.