CVE-2025-6429

Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an embed tag. This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerability was fixed in Firefox 140, Firefox E...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox versions prior to 140, which stems from allowing WebAuthn challenges despite invalid TLS certificates, which could lead to security risks...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox versions prior to 140, which stems from a memory security issue that could lead to memory corruption and the execution of arbitrary code...

PT-2025-26724

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140 Description: An attacker was able to bypass the connect-src directive of a Content Security Policy by manipulating subdocuments, which would have also hidden the connections from the Network tab in Devtools...

Astra Linux – Vulnerability in Firefox

Memory safety bugs exist in Firefox 139 and Thunderbird 139. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability has been fixed in Firefox 140 and Thunderbird...

Astra Linux – Vulnerability in Firefox

An attacker was able to bypass the connect-src directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools. This vulnerability was fixed in Firefox 140 and Thunderbird 140...

Slackware: Security Advisory (SSA:2025-140-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the microprogramming software for Intel Data Center GPU Flex 140 and Intel Data Center GPU Flex 170 lies in the possibility of operations being executed outside the buffer in memory, which can allow a hacker to cause a service failure.

The vulnerability of the microprogrammed graphics processor software of Intel Data Center GPU Flex 140 and Intel Data Center GPU Flex 170 lies in the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of Microprogrammed Graphics Processor Software for Intel Data Center GPU Flex 140 and Intel Data Center GPU Flex 170, related to access control deficiencies, allows attackers to trigger service failures.

The vulnerability of Intel Data Center GPU Flex 140 and Intel Data Center GPU Flex 170 graphics processors is related to deficiencies in access control. Exploiting this vulnerability could allow attackers to cause service failures...

The vulnerability of Microprogrammed Graphics Processor Software for Intel Data Center GPU Flex 140 and Intel Data Center GPU Flex 170, related to access control deficiencies, allows attackers to trigger service failures.

The vulnerability of Intel Data Center GPU Flex 140 and Intel Data Center GPU Flex 170 graphics processors is related to deficiencies in access control. Exploiting this vulnerability could allow attackers to cause service failures...

PT-2025-35800

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 140.0.7339.80 Description An inappropriate implementation in Downloads in Google Chrome on Android allowed a remote attacker to perform UI spoofing via a crafted HTML page. Recommendations Update Google Chrome t...

CVE-2025-2108: Improper Neutralization of Input During Web Page Generation

The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Site Title’ widget's 'titletag' and 'htmltag' parameters in all versions up to, and including, 1.4.6.8 due to insufficient input sanitization and output escaping. This...

CVE-2024-13649: Improper Neutralization of Input During Web Page Generation

The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.4.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2024-12584: Exposure of Sensitive Information to an Unauthorized Actor

The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6.2 via the 'duplicate' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to...

PT-2025-37011

Name of the Vulnerable Software and Affected Versions Chromium versions prior to 140.0.7339.127 Chromium versions 140.0.7339.127-1deb12u1 through 140.0.7339.127-1deb13u1 Chromium version 141.0.7390.76-alt0.p11.1 Description The issue involves an inappropriate implementation within the Mojo IPC...

CVE-2024-10319: Exposure of Sensitive Information to an Unauthorized Actor

The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6 via the render function in widgets/content-toggle/layout/frontend.php. This makes it possible for authenticated attackers, with...

[SECURITY] Fedora 40 Update: wolfssl-5.7.2-2.fc40

The wolfSSL embedded SSL library formerly CyaSSL is a lightweight SSL/TLS library written in ANSI C and targeted for embedded, RTOS, and resource-constrained environments - primarily because of its small size, speed, and feature set. It is commonly used in standard operating environments as well...

CVE-2024-7791: Improper Neutralization of Input During Web Page Generation

The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘arrow’ parameter within the Post Grid widget in all versions up to, and including, 1.4.4.3 due to insufficient input sanitization and output escaping. This makes it...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-42229)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-42229 advisory. - In the Linux kernel, the following vulnerability has been resolved: crypto: aead,cipher - zeroize key buffer...

GHSA-XJ87-MQVH-88W2 fish-shop/syntax-check Improper Neutralization of Delimiters

Impact Improper neutralisation of delimiters in the pattern input specifically the command separator ; and command substitution characters and mean that arbitrary command injection is possible by modification of the input value used in a workflow. This has the potential for exposure or exfiltrati...