Mozilla Firefox < 51.0.3

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 51.0.3. It is, therefore, affected by a vulnerability as referenced in the mfsa2017-04 advisory. - The cache directory on the local file system is set to be world writable. Firefox defaults to extracting libraries...

Mozilla Firefox < 62.0.2

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 62.0.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2018-22 advisory. - A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local...

Mozilla Firefox ESR < 60.2.1

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 60.2.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2018-23 advisory. - A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored i...

Siemens SCALANCE and RUGGEDCOM Devices Improper Input Validation (CVE-2024-50278)

dm cache: potential out-of-bounds access on the first resume Out-of- bounds access occurs if the fast device is expanded unexpectedly before the first-time resume of the cache table. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

EUVD-2025-197878

NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions from 22.11 to before 25.05 and versions before Unstable 25.11, a hard-coded secret was used in the NixOS module for the OnlyOffice document server to protec...

CVE-2025-64766 NixOS has hardcoded credentials in Onlyoffice module

NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions from 22.11 to before 25.05 and versions before Unstable 25.11, a hard-coded secret was used in the NixOS module for the OnlyOffice document server to protec...

GO-2025-4091 Jellysweep uses uncontrolled data in image cache API endpoint in github.com/jon4hz/jellysweep

Jellysweep uses uncontrolled data in image cache API endpoint in github.com/jon4hz/jellysweep...

CVE-2025-9317

The vulnerability, if exploited, could allow a miscreant with read access to Edge Project files or Edge Offline Cache files to reverse engineer Edge users' app-native or Active Directory passwords through computational brute-forcing of weak hashes...

CVE-2025-9501

The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the parsedynamicmfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post...

CVE-2025-9501 W3 Total Cache < 2.8.13 - Unauthenticated Command Injection

The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the parsedynamicmfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post...

CVE-2025-9501

CVE-2025-9501 - W3 Total Cache (WordPress) : The vulnerability affects the WordPress W3 Total Cache plugin up to version 2.8.13. The root cause is a command injection in the _parse_dynamic_mfunc function that allows unauthenticated users to submit a malicious payload in a post comment to execute ...

Alibaba Cloud Linux 3 : 0171: bind (ALINUX3-SA-2025:0171)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2025:0171 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-8677: A vulnerability was found i...

ONLYOFFICE Docs 信任管理问题漏洞

ONLYOFFICE Docs is an online office software from ONLYOFFICE, Inc. A trust management issue vulnerability exists in ONLYOFFICE Docs versions 22.11 through prior to 25.05 and prior to 25.11, which stems from the use of a hard-coded key to protect the file cache, which could lead to accessing known...

WordPress plugin W3 Total Cache 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

The vulnerability of the ipi_remote_fence_i() function in the arch/riscv/mm/cacheflush.c module on RISC-V architecture processors in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the ipiremotefencei function in the arch/riscv/mm/cacheflush.c module on RISC-V architecture processors in Linux operating systems is related to improper resource management. Exploiting this vulnerability could allow an attacker to cause a service failure...

SUSE SLES15 Security Update : bind (SUSE-SU-2025:4107-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4107-1 advisory. - CVE-2025-40778: Address various spoofing attacks bsc1252379. - CVE-2025-40780: Cache-poisoning due to weak pseudo-random number...

SUSE SLES15 Security Update : bind (SUSE-SU-2025:4108-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4108-1 advisory. - CVE-2025-40778: Address various spoofing attacks bsc1252379. - CVE-2025-40780: Cache-poisoning due to weak pseudo-random number...

SUSE SLED15: bind / bind-chrootenv / bind-devel / bind-doc / bind-utils / etc (SUSE-SU-2025:4109-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4109-1 advisory. - CVE-2025-40778: Address various spoofing attacks bsc1252379. - CVE-2025-40780: Cache-poisoning due to weak...

Whose Narrative Is It Anyway? A KV Cache Manipulation Attack

The Key ValueKV cache is an important component for efficient inference in autoregressive Large Language Models LLMs, but its role as a representation of the model's internal state makes it a potential target for integrity attacks. This paper introduces "History Swapping," a novel block-level...

Fedora 42 : bind9-next (2025-d9f9394ecd)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-d9f9394ecd advisory. Update to 9.21.14 rhbz2394406 Security Fixes: - DNSSEC validation fails if matching but invalid DNSKEY is found. CVE-2025-8677 - Address various...