NVIDIA Resiliency Extension 安全漏洞

NVIDIA Resiliency Extension is a Python package from NVIDIA. A security vulnerability exists in NVIDIA Resiliency Extension that originates from predictable log file names in log aggregation and could lead to elevation of privilege, code execution, denial of service, information disclosure, and...

PT-2025-51772

Name of the Vulnerable Software and Affected Versions PyMdown Extensions versions prior to 10.16.1 Description PyMdown Extensions, a set of extensions for the Python-Markdown project, contains a Regular Expression Denial of Service ReDoS issue within the figure caption extension...

Security Bulletin: NVIDIA Resiliency Extension - December 2025

NVIDIA has released a software update for NVIDIA® Resiliency Extension. To protect your system, clone or update this software to version 0.5.0 or later from NVIDIA Resiliency Extension on GitHub. Go to NVIDIA Product Security...

ALSA-2025:23309 Moderate: php:8.3 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: pgsql extension does not check for errors during escaping CVE-2025-1735 php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix CVE-2025-6491 php: PHP Hostname Nul...

NVIDIA Resiliency Extension 竞争条件问题漏洞

NVIDIA Resiliency Extension is a Python package from NVIDIA. NVIDIA Resiliency Extension suffers from a Competitive Condition Issue vulnerability that stems from the presence of a competitive condition in the checkpoint kernel, which could lead to information disclosure, data tampering, denial of...

PyMdown Extensions 安全漏洞

PyMdown Extensions is a collection of extensions for Python Markdown by the individual developer Isaac Muse. A security vulnerability exists in PyMdown Extensions versions prior to 10.16.1, which stems from a ReDOS vulnerability in the configure caption extension, which could lead to prolonged...

Windows Exploitation Techniques: Winning Race Conditions with Path Lookups

Posted by James Forshaw This post was originally written in 2016 for the Project Zero blog. However, in the end it was published separately in the journal PoC||GTFOissue 13 as well as in the second volume of the printed version. In honor of our new blog we’re republishing it on this blog and...

A Browser Extension Risk Guide After the ShadyPanda Campaign

In early December 2025, security researchers exposed a cybercrime campaign that had quietly hijacked popular Chrome and Edge browser extensions on a massive scale. A threat group dubbed ShadyPanda spent seven years playing the long game, publishing or acquiring harmless extensions, letting them r...

Exploit for Deserialization of Untrusted Data in Facebook React

React2P4IM0Nshell 💥Extension Tool para...

CeLLMate: Sandboxing Browser AI Agents

Browser-using agents BUAs are an emerging class of autonomous agents that interact with web browsers in human-like ways, including clicking, scrolling, filling forms, and navigating across pages. While these agents help automate repetitive online tasks, they are vulnerable to prompt injection...

Out-of-Bounds Read

mongodb/mongodb-extension is vulnerable to Out-of-Bounds Read. The vulnerability is due to improper handling of large options in mongocbulkoperationt, which allows an attacker to trigger invalid memory reads and potentially cause a crash or information disclosure...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell CVE-2025-55182 Scanner & Exploit Toolkit for Next...

CVE-2025-14265

In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of...

PT-2025-50977

Name of the Vulnerable Software and Affected Versions Lightning Flow Scanner versions 6.10.5 and below Description Lightning Flow Scanner, a CLI plugin, VS Code Extension, and GitHub Action for Salesforce Flow analysis and optimization, is affected by an issue where maliciously crafted flow...

CVE-2025-67646

TableProgressTracking is a MediaWiki extension to track progress against specific criterion. Versions 1.2.0 and below do not enforce CSRF token validation in the REST API. As a result, an attacker could craft a malicious webpage that, when visited by an authenticated user on a wiki with the...

Exploit for Deserialization of Untrusted Data in Facebook React

react2shellburp CVE-2025-55182 Burp Suite extension for ide...

CVE-2025-14265 Improper server-side validation in ScreenConnect extension framework

In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of...

CVE-2025-14265

CVE-2025-14265 (ScreenConnect) affects the ScreenConnect server component (not host/guest clients). The issue is due to insufficient server-side validation and integrity checks within the extension subsystem, allowing the installation and execution of untrusted or arbitrary extensions by authoriz...

CVE-2025-14265 Improper server-side validation in ScreenConnect extension framework

In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of...

Cross-site Scripting (XSS)

@tiptap/extension-link is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to unsanitized user input in link-setting functionality, allowing attackers to inject javascript: URLs that execute arbitrary JavaScript when interacted with...