CVE-2025-4091

Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox 13...

CVE-2025-4086

A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. This bug only affects Thunderbird for Android. Other versions of Thunderbird are unaffected. This vulnerability affects Firefox 138 and...

What privacy? Perplexity wants your data, builds browser to track you and serve ads

AI search service Perplexity AI doesn't just want you using its app—it wants to take over your web browsing experience too. The company is planning to launch its own browser, called Comet, next month. But what does this mean for your privacy? Launched in 2022, Perplexity AI is an AI-powered searc...

CVE-2025-23376

Dell PowerProtect Data Manager Reporting, versions 19.16, 19.17, 19.18, contains an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure...

CVE-2025-30204 affecting package moby-engine for versions less than 24.0.9-16

CVE-2025-30204 affecting package moby-engine for versions less than 24.0.9-16. A patched version of the package is available...

CVE-2025-23376

Dell PowerProtect Data Manager Reporting, versions 19.16, 19.17, 19.18, contains an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure...

Exploit for CVE-2024-31449

CVE-2024-31449 Redis는 오픈 소스 인메모리 비관계형 데이터베이스이다. 요약 - Redis...

QuickJS 安全漏洞

QuickJS is a small and embeddable Javascript engine open-sourced by QuickJS. A security vulnerability exists in QuickJS 0.9.0 and earlier versions, which stems from a lack of length checking in JSReadString, and may result in a heap buffer overflow...

Arbitrary Code Injection

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Arbitrary Code Injection via the template rendering engine. An attacker can execute arbitrary code on the server by injecting malicious code into templates that are then executed by the serve...

Unsound public API in unmaintained crate

The following functions in the tantonengine crate are unsound due to lack of sufficient boundary checks in public API: - Stack::offset - ThreadStack::get - RootMoveList::insertscoredepth - RootMoveList::insertscore The tantonengine crate is no longer maintained, so there are no plans to fix this...

PT-2025-20014 · Crates.Io · Tanton Engine

The following functions in the tanton engine crate are unsound due to lack of sufficient boundary checks in public API: - Stack::offset - ThreadStack::get - RootMoveList::insert score depth - RootMoveList::insert score The tanton engine crate is no longer maintained, so there are no plans to...

Ubuntu 20.04 LTS : Linux kernel (Intel IoTG) vulnerabilities (USN-7459-1)

"The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7459-1 advisory. Jann Horn discovered that the watchqueue event notification subsystem in the Linux kernel contained an out-of-bounds write vulnerability. A local attack...

CVE-2025-30204 affecting package moby-engine for versions less than 25.0.3-12

CVE-2025-30204 affecting package moby-engine for versions less than 25.0.3-12. A patched version of the package is available...

[SECURITY] Fedora 41 Update: chromium-135.0.7049.95-1.fc41

Chromium is an open-source web browser, powered by WebKit Blink...

The vulnerability of the Packet Forwarding Engine (PFE) module in Junos OS routers of the MX series allows a hacker to cause a service failure.

The vulnerability of the Packet Forwarding Engine PFE module in Junos OS routers of the MX series is related to memory release errors. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

The vulnerability of the Packet Forwarding Engine (PFE) module in Juniper Networks’ Junos OS and Junos OS Evolved operating systems allows a hacker to trigger a service failure.

The vulnerability of the Packet Forwarding Engine PFE module in Juniper Networks’ Junos OS and Junos OS Evolved operating systems is related to memory release errors. Exploiting this vulnerability can allow a malicious actor to trigger service failures using specially created ARP packets in the...

CVE-2025-3795

A vulnerability was found in DaiCuo 1.3.13. It has been rated as problematic. Affected by this issue is some unknown functionality of the component SEO Optimization Settings Section. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclose...

Care what you share

Welcome to this week's edition of the Threat Source newsletter. As we navigate our daily routines, certain tasks become second nature to us, especially if they are integral to our professions. However, what feels instinctive to one person might be foreign to another. This disparity is akin to a...

CVE-2025-3113 Improper Access Control in Delphix Masking Engine

A valid, authenticated user with sufficient privileges and who is aware of Continuous Compliance’s internal database configurations can leverage the application’s built-in Connector functionality to access Continuous Compliance’s internal database. This allows the user to explore the internal...

CVE-2025-3113

CVE-2025-3113 affects Delphix Masking Engine via the built-in Connector feature that exposes Continuous Compliance’s internal database. The root cause is insufficient access control, enabling a valid, authenticated user with privileges to explore the internal database schema and export data, incl...