ALSA-2025:13780 Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: angle: insufficient input validation can cause undefined behavior CVE-2025-6558 webkitgtk: A download?s origin may be incorrectly associated CVE-2025-43240 webkitgtk: Processing maliciously...

PT-2025-33023 · Palo Alto Networks · Globalprotect

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks GlobalProtect app affected versions not specified Description: An insufficient certificate validation issue in the Palo Alto Networks GlobalProtect app allows attackers to connect the app to arbitrary servers. This can enab...

CVE-2025-49456

Race condition in the installer for certain Zoom Clients for Windows may allow an unauthenticated user to impact application integrity via local access...

CVE-2025-20093

creationtimestamp| type| source ---|---|--- 2025-08-12 18:29:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lw7wvwaxwf2q...

CVE-2025-53769

External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally...

CVE-2025-53769

External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally...

CVE-2025-53769 Windows Security App Spoofing Vulnerability

...

CVE-2025-53769 Windows Security App Spoofing Vulnerability

...

CVE-2025-53769

CVE-2025-53769 : Windows Security App contains a flaw enabling spoofing via external control of a file name or path, allowing an authorized local attacker to spoof UI. Affected: Windows Security App. Root cause: file/path parameter control leading to spoofing. Impact: local spoofing of user inter...

That “Amazon Safety Recall” message may well be a scam

Scammers are using the age old tactic of scaring victims into clicking by sending out fake product recall messages from Amazon. The text message tells you that the item does not meet Amazon’s standards, and tries to install some urgency by claiming it is not safe to use. It also includes a link...

Hotfix update for Exchange Server 2019 CU14: April 18, 2025 (KB5050673)

None None...

Description of the security update for Microsoft Exchange Server 2019: August 12, 2025 (KB5063222)

None None...

CVE-2025-30027

An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a...

CVE-2025-71325

creationtimestamp| type| source ---|---|--- 2025-08-12 00:13:55+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-9gvj-pp9x-gcfr 2026-06-17 17:42:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moiuewgeha24...

PT-2025-32763 · Adobe · Illustrator

Name of the Vulnerable Software and Affected Versions: Illustrator versions 28.7.8 and earlier Illustrator version 29.6.1 and earlier Description: Illustrator is susceptible to a NULL Pointer Dereference issue that may result in application denial-of-service. An attacker could exploit this issue ...

PT-2025-32851 · Microsoft · Windows Security App

Name of the Vulnerable Software and Affected Versions: Windows Security App affected versions not specified Description: The Windows Security App contains a flaw related to external control of file names or paths. This allows an authorized attacker to perform local spoofing. Recommendations: At t...

CVE-2025-38499

creationtimestamp| type| source ---|---|--- 2025-08-11 17:56:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lw5emybxzk2p 2025-12-03 14:14:49+00:00| seen| https://vulnerability.circl.lu/bundle/816dcc8e-f25a-4895-9b59-1bbd9caeccb8 2025-12-22 11:56:56+00:00| seen|...

CVE-2025-8863

creationtimestamp| type| source ---|---|--- 2025-08-11 15:46:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lw55e7eysf2q...

CVE-2025-8853

creationtimestamp| type| source ---|---|--- 2025-08-11 10:31:43+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lw4lqzs2to2m 2026-05-24 23:01:24+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mmn2yuxmtc2k...

A week in security (August 4 – August 10)

Last week on Malwarebytes Labs: Adult sites trick users into Liking Facebook posts using a clickjack Trojan Facebook users targeted in ‘login’ phish TeaOnHer, the male version of Tea, is leaking personal information on its users too How Google, Adidas, and more were breached in a Salesforce scam...