CVE-2025-53480

The CVE-2025-53480 issue affects the MediaWiki CheckUser extension on the Special:Investigate page, Account information tab. Root cause: specific internationalized messages are rendered without proper escaping, enabling reflected XSS when an attacker appends ?uselang=x-xss to the URL. Affected ve...

Microsoft MPEG-2 Video Extension Remote Code Execution Vulnerability

Use after free in Microsoft MPEG-2 Video Extension allows an authorized attacker to execute code locally...

Visual Studio Code Python Extension Remote Code Execution Vulnerability

Trust boundary violation in Visual Studio Code - Python extension allows an unauthorized attacker to execute code locally...

Malicious Pull Request Targets 6,000+ Developers via Vulnerable Ethcode VS Code Extension

Cybersecurity researchers have flagged a supply chain attack targeting a Microsoft Visual Studio Code VS Code extension called Ethcode that has been installed a little over 6,000 times. The compromise, per ReversingLabs, occurred via a GitHub pull request that was opened by a user named Airez299 ...

PT-2025-28539 · Microsoft · Mpeg-2 Video Extension +1

Name of the Vulnerable Software and Affected Versions: Microsoft MPEG-2 Video Extension affected versions not specified Description: The issue is related to a use after free condition in the Microsoft MPEG-2 Video Extension, which allows an authorized attacker to execute code locally...

Wikimedia Mediawiki - CheckUser Extension 安全漏洞

Wikimedia Mediawiki - CheckUser Extension is a Wikimedia Foundation extension for checking IP addresses. A security vulnerability exists in Wikimedia Mediawiki - CheckUser Extension, which stems from a specific internationalization message in the Account information tab that is not properly...

Microsoft MPEG-2 Video Extension 资源管理错误漏洞

Microsoft MPEG-2 Video Extension is a Microsoft Corporation USA playback of MPEG video in popular video applications on Windows 10 devices. A resource management error vulnerability exists in Microsoft MPEG-2 Video Extension. An attacker exploiting this vulnerability could remotely execute code...

PT-2025-28474 · Mediawiki · Mediawiki

Name of the Vulnerable Software and Affected Versions: Mediawiki - CheckUser extension versions 1.39.0 through 1.39.12 Mediawiki - CheckUser extension versions 1.42.0 through 1.42.6 Mediawiki - CheckUser extension versions 1.43.0 through 1.43.1 Description: The issue is related to the rendering o...

Microsoft MPEG-2 Video Extension 安全漏洞

Microsoft MPEG-2 Video Extension is a Microsoft Corporation USA playback of MPEG video in popular video applications on Windows 10 devices. A security vulnerability exists in Microsoft MPEG-2 Video Extension. An attacker could exploit the vulnerability to remotely execute code. The following...

Wikimedia Mediawiki - TitleIcon extension 安全漏洞

Wikimedia Mediawiki - TitleIcon extension is a title icon extension from the Wikimedia Foundation. A security vulnerability exists in Wikimedia Mediawiki - TitleIcon extension versions prior to 1.39.13, prior to 1.42.7, and prior to 1.43.2, which stems from an uncleaned titleiconunicode parser...

Wikimedia Mediawiki - MsUpload extension 安全漏洞

Wikimedia Mediawiki - MsUpload extension is a bulk file upload plugin from the Wikimedia Foundation. A security vulnerability exists in Wikimedia Mediawiki - MsUpload extension versions prior to 1.39.13, prior to 1.42.7, and prior to 1.43.2, which stems from stored cross-site scripting due to...

PT-2025-28538 · Microsoft · Mpeg-2 Video Extension +1

Name of the Vulnerable Software and Affected Versions: Microsoft MPEG-2 Video Extension affected versions not specified Description: The issue is related to a heap-based buffer overflow in the Microsoft MPEG-2 Video Extension, which allows an authorized attacker to execute code locally...

Wikimedia Mediawiki - CheckUser Extension 安全漏洞

Wikimedia Mediawiki - CheckUser Extension is a Wikimedia Foundation extension for querying IP addresses. A security vulnerability exists in Wikimedia Mediawiki - CheckUser Extension that stems from a rev-deleted-user message that is not properly escaped, which could lead to a reflected cross-site...

PT-2025-28605

Name of the Vulnerable Software and Affected Versions: Visual Studio Code - Python extension affected versions not specified Description: The issue is related to a trust boundary violation in the Visual Studio Code - Python extension, allowing an unauthorized attacker to execute code locally...

PT-2025-28632 · Mediawiki · Mediawiki

Name of the Vulnerable Software and Affected Versions: MediaWiki - CheckUser extension versions 1.39.X through 1.39.13 MediaWiki - CheckUser extension versions 1.42.X through 1.42.7 MediaWiki - CheckUser extension versions 1.43.X through 1.43.2 Description: The Special:CheckUser interface is...

PT-2025-28642 · Mediawiki · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki - TitleIcon extension versions 1.39.X through 1.39.12 MediaWiki - TitleIcon extension versions 1.42.X through 1.42.6 MediaWiki - TitleIcon extension versions 1.43.X through 1.43.1 Description: The TitleIcon extension for MediaWiki i...

Security Update for Microsoft Visual Studio Code Python Extension (July 2025)

The Microsoft Visual Studio Code Python Extension is prior to version 2025.8.1. It is, therefore, affected by an undisclosed remote code execution vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...

CVE-2025-53496

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - MediaSearch Extension allows Stored XSS.This issue affects Mediawiki - MediaSearch Extension: from 1.42.X before 1.42.7, from 1.43.X before 1.43.2...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the abusefiltercheckmatch API. An attacker can access protected variables by bypassing authorization controls. Remediation Upgrade mediawiki/abuse-filter to version 1.43 or higher. References - Fix Commit -...

CVE-2025-53488

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - WikiHiero Extension allows Stored XSS.This issue affects Mediawiki - WikiHiero Extension: from 1.43.X before 1.43.2...