{
"Source": "CVE FEED",
"Title": "CVE-2025-39954 - clk: sunxi-ng: mp: Fix dual-divider clock rate readback",
"Content": "CVE ID : CVE-2025-39954
Published : 9 Oct 2025, 9:47 a.m. | 14 minutes ago
Description : In the Linux kernel, the following vulnerability has been resolved:

clk: sunxi-ng: mp: Fix dual-divider clock rate readback

When dual-divider clock support was introduced, the P divider offset was
left out of the .recalc_rate readback function. This causes the clock
rate to become bogus or even zero (possibly due to the P divider being
1, leading to a divide-by-zero).

Fix this by incorporating the P divider offset into the calculation.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "09 Oct 2025",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-10862 - Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.3 - unauthenticated sql injection via 'id'",
"Content": "CVE ID : CVE-2025-10862
Published : 9 Oct 2025, 9:15 a.m. | 46 minutes ago
Description : The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.1.3. This is due to insufficient escaping on the 'id' parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "09 Oct 2025",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-2934 - Allocation of Resources Without Limits or Throttling in GitLab",
"Content": "CVE ID : CVE-2025-2934
Published : 9 Oct 2025, 11:33 a.m. | 30 minutes ago
Description : GitLab has remediated an issue in GitLab CE/EE affecting all versions from 5.2 prior to 18.2.8, 18.3 prior to 18.3.4, and 18.4 prior to 18.4.2 that could have allowed an authenticated attacker to create a denial of service condition by configuring malicious webhook endpoints that send crafted HTTP responses.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "09 Oct 2025",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-10249 - Slider Revolution <= 6.7.37 - missing authorization to authenticated (contributor+) arbitrary file read",
"Content": "CVE ID : CVE-2025-10249
Published : 9 Oct 2025, 11:20 a.m. | 43 minutes ago
Description : The Slider Revolution plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions in all versions up to, and including, 6.7.37. This makes it possible for authenticated attackers, with Contributor-level access and above, to install and activate plugin add-ons, create sliders, and download arbitrary files.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "09 Oct 2025",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-9371 - Betheme <= 28.1.6 - authenticated (contributor+) stored cross-site scripting via 'page_title'",
"Content": "CVE ID : CVE-2025-9371
Published : 9 Oct 2025, 11:20 a.m. | 43 minutes ago
Description : The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘page_title’ parameter in all versions up to, and including, 28.1.6 due to insufficient input sanitization and output escaping of theme breadcrumbs. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "09 Oct 2025",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-36225 - IBM Aspera Faspex information disclosure",
"Content": "CVE ID : CVE-2025-36225
Published : 9 Oct 2025, 1:56 p.m. | 9 minutes ago
Description : IBM Aspera 5.0.0 through 5.0.13.1

could disclose sensitive user information from the system to an authenticated user due to an observable discrepancy of returned data.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "09 Oct 2025",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2023-37401 - IBM Aspera Faspex cross-origin resource sharing",
"Content": "CVE ID : CVE-2023-37401
Published : 9 Oct 2025, 1:54 p.m. | 10 minutes ago
Description : IBM Aspera Faspex 5.0.0 through 5.0.13.1 uses a cross-domain policy file that includes domains that should not be trusted.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "09 Oct 2025",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-11561 - Sssd: sssd default kerberos configuration allows privilege escalation on ad-joined linux systems",
"Content": "CVE ID : CVE-2025-11561
Published : 9 Oct 2025, 1:37 p.m. | 27 minutes ago
Description : A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, SSSD does not enable the Kerberos local authentication plugin (sssd_krb5_localauth_plugin), allowing an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users. This can result in unauthorized access or privilege escalation on domain-joined Linux hosts.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "09 Oct 2025",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-62228 - Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC: SQL injection via maliciously crafted identifiers",
"Content": "CVE ID : CVE-2025-62228
Published : 9 Oct 2025, 1:15 p.m. | 49 minutes ago
Description : Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, we recommend users update Flink CDC version to 3.5.0 which address this issue.
Severity: 5.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "09 Oct 2025",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-39960 - gpiolib: acpi: initialize acpi_gpio_info struct",
"Content": "CVE ID : CVE-2025-39960
Published : 9 Oct 2025, 1:15 p.m. | 49 minutes ago
Description : In the Linux kernel, the following vulnerability has been resolved:

gpiolib: acpi: initialize acpi_gpio_info struct

Since commit 7c010d463372 ("gpiolib: acpi: Make sure we fill struct
acpi_gpio_info"), uninitialized acpi_gpio_info struct are passed to
__acpi_find_gpio() and later in the call stack info->quirks is used in
acpi_populate_gpio_lookup. This breaks the i2c_hid_cpi driver:

[ 58.122916] i2c_hid_acpi i2c-UNIW0001:00: HID over i2c has not been provided an Int IRQ
[ 58.123097] i2c_hid_acpi i2c-UNIW0001:00: probe with driver i2c_hid_acpi failed with error -22

Fix this by initializing the acpi_gpio_info pass to __acpi_find_gpio()
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "09 Oct 2025",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-39961 - iommu/amd/pgtbl: Fix possible race while increase page table level",
"Content": "CVE ID : CVE-2025-39961
Published : 9 Oct 2025, 1:15 p.m. | 49 minutes ago
Description : In the Linux kernel, the following vulnerability has been resolved:

iommu/amd/pgtbl: Fix possible race while increase page table level

The AMD IOMMU host page table implementation supports dynamic page table levels
(up to 6 levels), starting with a 3-level configuration that expands based on
IOVA address. The kernel maintains a root pointer and current page table level
to enable proper page table walks in alloc_pte()/fetch_pte() operations.

The IOMMU IOVA allocator initially starts with 32-bit address and onces its
exhuasted it switches to 64-bit address (max address is determined based
on IOMMU and device DMA capability). To support larger IOVA, AMD IOMMU
driver increases page table level.

But in unmap path (iommu_v1_unmap_pages()), fetch_pte() reads
pgtable->[root/mode] without lock. So its possible that in exteme corner case,
when increase_address_space() is updating pgtable->[root/mode], fetch_pte()
reads wrong page table level (pgtable->mode). It does compare the value with
level encoded in page table and returns NULL. This will result is
iommu_unmap ops to fail and upper layer may retry/log WARN_ON.

CPU 0 CPU 1
------ ------
map pages unmap pages
alloc_pte() -> increase_address_space() iommu_v1_unmap_pages() -> fetch_pte()
pgtable->root = pte (new root value)
READ pgtable->[mode/root]
Reads new root, old mode
Updates mode (pgtable->mode += 1)

Since Page table level updates are infrequent and already synchronized with a
spinlock, implement seqcount to enable lock-free read operations on the read path.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "09 Oct 2025",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-39962 - rxrpc: Fix untrusted unsigned subtract",
"Content": "CVE ID : CVE-2025-39962
Published : 9 Oct 2025, 1:15 p.m. | 49 minutes ago
Description : In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix untrusted unsigned subtract

Fix the following Smatch static checker warning:

net/rxrpc/rxgk_app.c:65 rxgk_yfs_decode_ticket()
warn: untrusted unsigned subtract. 'ticket_len - 10 * 4'

by prechecking the length of what we're trying to extract in two places in
the token and decoding for a response packet.

Also use sizeof() on the struct we're extracting rather specifying the size
numerically to be consistent with the other related statements.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "09 Oct 2025",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-39963 - io_uring: fix incorrect io_kiocb reference in io_link_skb",
"Content": "CVE ID : CVE-2025-39963
Published : 9 Oct 2025, 1:15 p.m. | 49 minutes ago
Description : In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix incorrect io_kiocb reference in io_link_skb

In io_link_skb function, there is a bug where prev_notif is incorrectly
assigned using 'nd' instead of 'prev_nd'. This causes the context
validation check to compare the current notification with itself instead
of comparing it with the previous notification.

Fix by using the correct prev_nd parameter when obtaining prev_notif.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "09 Oct 2025",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-10239 - Unintended command execution via troubleshooting scripts in Progress Flowmon",
"Content": "CVE ID : CVE-2025-10239
Published : 9 Oct 2025, 1:15 p.m. | 49 minutes ago
Description : In Flowmon versions prior to 12.5.5, a vulnerability has been identified that allows a user with administrator privileges and access to the management interface to execute additional unintended commands within scripts intended for troubleshooting purposes.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "09 Oct 2025",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-10240 - Possibility of unintended actions when a user clicks a malicious link in the Progress Flowmon web application",
"Content": "CVE ID : CVE-2025-10240
Published : 9 Oct 2025, 1:15 p.m. | 49 minutes ago
Description : A vulnerability exists in the Progress Flowmon web application prior to version 12.5.5, whereby a user who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated session.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "09 Oct 2025",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-11340 - Incorrect Authorization in GitLab",
"Content": "CVE ID : CVE-2025-11340
Published : 9 Oct 2025, 12:15 p.m. | 1 hour, 49 minutes ago
Description : GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 to 18.3.4, 18.4 to 18.4.2 that, under certain conditions, could have allowed authenticated users with read-only API tokens to perform unauthorized write operations on vulnerability records by exploiting incorrectly scoped GraphQL mutations.
Severity: 7.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "09 Oct 2025",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-10004 - Allocation of Resources Without Limits or Throttling in GitLab",
"Content": "CVE ID : CVE-2025-10004
Published : 9 Oct 2025, 12:15 p.m. | 1 hour, 49 minutes ago
Description : GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.12 to 18.2.8, 18.3 to 18.3.4, and 18.4 to 18.4.2 that could make the GitLab instance unresponsive or severely degraded by sending crafted GraphQL queries requesting large repository blobs.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "09 Oct 2025",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-59968 - Junos Space Security Director: Insufficient authorization for sensitive resources in web interface",
"Content": "CVE ID : CVE-2025-59968
Published : Oct. 9, 2025, 3:48 p.m. | 24 minutes ago
Description : A Missing Authorization vulnerability in the Juniper Networks Junos Space Security Director allows an unauthenticated network-based attacker to read or modify metadata via the web interface. 




Tampering with this metadata can result in managed SRX Series devices permitting network traffic that should otherwise be blocked by policy, effectively bypassing intended security controls.



This issue affects Junos Space Security Director
* all versions prior to 24.1R3 Patch V4


This issue does not affect managed cSRX Series devices.
Severity: 8.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "09 Oct 2025",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-59967 - Junos OS Evolved: ACX7024, ACX7024X, ACX7100-32C, ACX7100-48L, ACX7348, ACX7509: When specific valid multicast traffic is received on the L3 interface on a vulnerable device evo-pfemand crashes and restarts",
"Content": "CVE ID : CVE-2025-59967
Published : Oct. 9, 2025, 3:47 p.m. | 25 minutes ago
Description : A NULL Pointer Dereference vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved on ACX7024, ACX7024X, ACX7100-32C, ACX7100-48L, ACX7348, ACX7509 devices allows an unauthenticated, adjacent attacker to cause a

Denial-of-Service (DoS).

Whenever specific valid multicast traffic is received on any layer 3 interface the evo-pfemand process crashes and restarts.

Continued receipt of specific valid multicast traffic results in a sustained Denial of Service (DoS) attack.
This issue affects Junos OS Evolved on ACX7024, ACX7024X, ACX7100-32C, ACX7100-48L, ACX7348, ACX7509: 



* from 23.2R2-EVO before 23.2R2-S4-EVO, 
* from 23.4R1-EVO before 23.4R2-EVO.


This issue affects IPv4 and IPv6.

This issue does not affect Junos OS Evolved ACX7024, ACX7024X, ACX7100-32C, ACX7100-48L, ACX7348, ACX7509 versions before 23.2R2-EVO.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "09 Oct 2025",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-59964 - Junos OS: SRX4700: When forwarding-options sampling is enabled any traffic destined to the RE will cause the forwarding line card to crash and restart",
"Content": "CVE ID : CVE-2025-59964
Published : Oct. 9, 2025, 3:46 p.m. | 26 minutes ago
Description : A Use of Uninitialized Resource vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX4700 devices allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).

When forwarding-options sampling is enabled, receipt of any traffic destined to the Routing Engine (RE) by the PFE line card leads to an FPC crash and restart, resulting in a Denial of Service (DoS).

Continued receipt and processing of any traffic leading to the RE by the PFE line card will create a sustained Denial of Service (DoS) condition to the PFE line card.


This issue affects Junos OS on SRX4700: 



* from 24.4 before 24.4R1-S3, 24.4R2


This issue affects IPv4 and IPv6.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "09 Oct 2025",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹

{
"Source": "CVE FEED",
"Title": "CVE-2025-10284 - Improper Archive Extraction in unarchive Enables RCE",
"Content": "CVE ID : CVE-2025-10284
Published : Oct. 9, 2025, 3:46 p.m. | 26 minutes ago
Description : BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, resulting in remote code execution.
Severity: 9.6 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...",
"Detection Date": "09 Oct 2025",
"Type": "Vulnerability"
}
🔹 t.me/cvedetector 🔹