What needs attention now.

tcp: prevent collapsing skbs across boundary in rtx queue

• Linux kernel

sctp: discard the rest of the packet on a stale-cookie error

• Linux kernel

net: openvswitch: conntrack: fix helper UAF due to extensions realloc

• Linux kernel

RISC-V: KVM: Synchronize hrtimer callback during teardown

• Linux kernel

WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor

• clidey whodb
• Path traversal

Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway

• vanus
• CWE-1392

WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability

• QuantumCloud Conversational Forms for ChatBot
• Insecure deserialization

WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability

• Arraytics Booktics
• SQL injection

WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability

• Brainstorm Force OttoKit
• Privilege escalation

phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection

• thorsten phpMyFAQ
• Authentication bypass

LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Insecure deserialization

Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter

• Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
• Authentication bypass

Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.

• mage-ai
• CWE-390

Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse

• CWE-1286

Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine

• CWE-116

Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print

• CWE-116

Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline

• Memory corruption
• CWE-911

LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport

• Authentication bypass
• Insecure deserialization

>=0.3.9, <0.5.6 · fixed in 0.5.6

Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution

• Command injection
• CWE-20

<0.2.121 · fixed in 0.2.121

Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)

• Apache Software Foundation Apache Kylin
• Authentication bypass

ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)

• zoneminder
• Command injection

Apache Kylin: Unauthenticated Metastore Cleanup

• Apache Software Foundation Apache Kylin
• Authentication bypass

Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok()

• Netcore NR256CN
• Memory corruption

WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup

• canove whaticket-community
• Privilege escalation

LangChat through commit 2a6285a Missing Authentication on REST API Controllers

• langchat
• Authentication bypass

DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials

• databuff
• CWE-1392

DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret

• databuff
• Hard-coded credentials

WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header

• wimoor
• Authentication bypass

Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass

• suyuan32 simple-admin-core
• Hard-coded credentials

WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint

• rachelos we-mp-rss
• Code injection

Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover

• xiaochong0302 course-tencent-cloud
• Authentication bypass

IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints

• Thecosy IceCMS
• Authentication bypass

Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation

• chaskiq
• Server-side request forgery (SSRF)

Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback

• l429609201 misaka_danmu_server
• Authentication bypass

FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints

• FastapiAdmin
• Authentication bypass

OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret

• OpenBMB StaffDeck
• Hard-coded credentials

Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers

• Webreaper Damselfly
• Authentication bypass

Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling

• FreeRTOS-Plus-TCP
• CWE-940

Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel

• FreeRTOS-Kernel
• Memory corruption
• CWE-197

Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel

• FreeRTOS-Kernel
• Broken access control

RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read

• RIOT
• Memory corruption

RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID

• RIOT
• Memory corruption

RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access

• RIOT
• Memory corruption

MariaDB: Use-after-free with a large number of SYS_REFCURSOR's

• MariaDB server
• Memory corruption

MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections

• MariaDB server
• Memory corruption

MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.

• MariaDB server
• CWE-706

Dockhand: Unauthenticated container exec via WebSocket upgrade

• Finsys dockhand
• Authentication bypass
• Broken access control

countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context

• countly-server
• Cross-site scripting (XSS)

J4Care dcm4che Missing Authentication for Critical Function

• J4Care dcm4chee-arc-light
• Authentication bypass

Guangzhou Juan IoT Technology EseeCloud Use of Hard-coded Credentials

• Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App
• Guangzhou Juan IoT Technology Co., Ltd. EseeCloud Firmware
• Hard-coded credentials

Improper Encoding or Escaping of Output in Crafty Controller

• Arcadia Technology, LLC Crafty Controller
• CWE-116

Apache Kylin: Missing authentication on certain cache API endpoints

• Apache Software Foundation Apache Kylin
• SQL injection
• Authentication bypass

Apache Kylin: Redis unsafe Java deserialization

• Apache Software Foundation Apache Kylin
• Insecure deserialization

Apache Kylin: Missing authorization and path-confinement on system meta dump

• Apache Software Foundation Apache Kylin
• Broken access control

SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter

• sgl-project sglang
• Code injection

SQL injection in TSG Profleet

• TSG Profleet
• SQL injection

WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability

• Theme-one The Grid
• Code injection

WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability

• halfdata Green Popups
• SQL injection

Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter

• sunshinephotocart Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
• Insecure deserialization

ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment

• elextensions ELEX WordPress HelpDesk & Customer Ticketing System
• Unrestricted file upload