The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

...

btrfs: harden block_group::bg_list against list_del() races

...

Khronos Group glslang Intermediate.cpp isConversionAllowed null pointer dereference

...

PT-2025-35909

Name of the Vulnerable Software and Affected Versions: appRain CMF version 4.0.5 Description: A stored authenticated cross-site scripting XSS issue exists due to insufficient validation of user-supplied data. The vulnerability is triggered through the dataGroupname parameter in the...

Linux Distros Unpatched Vulnerability : CVE-2019-10188

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in the same quiz...

Linux Distros Unpatched Vulnerability : CVE-2019-10189

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in an assignment group could modify group overrides for other groups in the same...

Jaguar Land Rover Cyberattack Disrupts Production and Sales Operations

Jaguar Land Rover is restoring systems after a cyberattack disrupted production and sales, with a hacker group previously…...

When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.

...

CVE-2025-58626

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RumbleTalk RumbleTalk Live Group Chat rumbletalk-chat-a-chat-with-themes allows Stored XSS.This issue affects RumbleTalk Live Group Chat: from n/a through = 6.3.5...

CVE-2025-58626

CVE-2025-58626 corresponds to a stored XSS vulnerability in the WordPress plugin RumbleTalk Live Group Chat (HTML5) affecting versions up to and including 6.3.5 . The issue stems from improper input neutralization during web page generation, enabling stored cross-site scripting and impacting site...

CVE-2025-58626 WordPress RumbleTalk Live Group Chat Plugin <= 6.3.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RumbleTalk RumbleTalk Live Group Chat rumbletalk-chat-a-chat-with-themes allows Stored XSS.This issue affects RumbleTalk Live Group Chat: from n/a through = 6.3.5...

PT-2025-35759

Name of the Vulnerable Software and Affected Versions: RumbleTalk Live Group Chat versions through 6.3.5 Description: RumbleTalk Live Group Chat is susceptible to a cross-site scripting XSS issue due to improper neutralization of input during web page generation. This allows for stored XSS attack...

Huawei EulerOS: Security Advisory for libcap (EulerOS-SA-2025-1911)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Linux Distros Unpatched Vulnerability : CVE-2016-4861

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The 1 order and 2 group methods in ZendDbSelect in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging...

WordPress plugin RumbleTalk Live Group Chat 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

Huawei EulerOS: Security Advisory for libcap (EulerOS-SA-2025-1893)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Linux Distros Unpatched Vulnerability : CVE-2020-1754

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewin...

Linux Distros Unpatched Vulnerability : CVE-2022-40316

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users i...

Linux Distros Unpatched Vulnerability : CVE-2020-25700

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5...

Lazarus Group Expands Malware Arsenal With PondRAT, ThemeForestRAT, and RemotePE

The North Korea-linked threat actor known as the Lazarus Group has been attributed to a social engineering campaign that distributes three different pieces of cross-platform malware called PondRAT, ThemeForestRAT, and RemotePE. The attack, observed by NCC Group's Fox-IT in 2024, targeted an...