CVE-2025-13639

Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. Chromium security severity: Low...

CVE-2025-13633

Use after free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2025-13639

Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. Chromium security severity: Low...

CVE-2025-13639

Summary: CVE-2025-13639 is an issue in the WebRTC implementation of Google Chrome/Chromium. Affected component: WebRTC in Chrome/Chromium prior to version 143.0.7499.41. Impact: Remote attacker could cause arbitrary read/write via a crafted HTML page (confidentiality and integrity impact; availab...

CVE-2025-13630

CVE-2025-13630 is a Type Confusion in V8 in Google Chrome that could enable remote heap corruption via a crafted HTML page. Affected product is Chromium/Chrome (V8 engine); the issue is fixed in a Chrome/Chromium update ≥ 143.0.7499.41 (ChromeOS notes show related patching in the 143.0.7499.x fam...

CVE-2025-66460 Lookyloo vulnerable to XSS due to lack of escaping in HTML elements passed to Datatables

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, Lookyloo passed improperly escaped values to cells rendered in datatables using the orthogonal-data feature. It is definitely exploitable from the popu...

GHSA-69JW-4JJ8-FCXM gokey allows secret recovery from a seed file without the master password

In gokey versions 0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM authentication tag of the key seed. This issue has been fixed in gokey version 0.2.0. This is a breaking change. The fix has invalidated any...

PT-2025-48600

Name of the Vulnerable Software and Affected Versions MotionPhoto versions prior to 4.1.51 Description An improper access control issue exists in the MPLocalService component of MotionPhoto. This allows local attackers to initiate a privileged service. Recommendations Update MotionPhoto to versio...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, Inc USA. A security vulnerability exists in Google Chrome prior to version 143.0.7499.41, which stems from an improper implementation of the password feature that could allow a local attacker to bypass authentication via a physical access device...

CVE-2025-59485

CVE-2025-59485 affects Security Point (Windows) of MaLion prior to Ver.5.3.4. The flaw allows placing an arbitrary file in a specific folder by a logged-in user; if the file is a crafted DLL, it could execute code with SYSTEM privileges. Remediation: update to Security Point MaLion Ver.5.3.4 or l...

CVE-2025-12394

CVE-2025-12394 concerns the WordPress plugin Backup Migration. The vulnerability affects the plugin up to version 2.0.0, where it fails to generate the backup path correctly in certain server configurations. This allows unauthenticated users to read a log that reveals the backup filename, and the...

CVE-2025-65014 LibreNMS has Weak Password Policy

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a weak password policy vulnerability was identified in the user management functionality of the LibreNMS application. This vulnerability allows administrators to create accounts with extremely...

CVE-2025-13229

Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2025-55070

Mattermost versions 11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events...

DEBIAN-CVE-2025-9479

Out of bounds read in V8 in Google Chrome prior to 133.0.6943.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2024-13178

Inappropriate implementation in Fullscreen in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-13107

CVE-2025-13107 concerns an Inappropriate implementation in Compositing in Google Chrome prior to 140.0.7339.80 that enables a remote attacker to perform a UI spoofing attack via a crafted HTML page. The affected product is Google Chrome (Chromium-based); the root cause is an inadequate implementa...

CVE-2025-64747 Directus Vulnerable to Stored Cross-site Scripting

Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting XSS vulnerability exists in versions prior to 11.13.0 that allows users with upload files and edit item permissions to inject malicious JavaScript through the Block Editor interface...

firefox: thunderbird: Mitigation bypass in the DOM: Security component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: Security component...

PT-2025-46891

Name of the Vulnerable Software and Affected Versions Compressor versions prior to 4.11.1 Description An unauthenticated user on the same network as a Compressor server may be able to execute arbitrary code. The issue was addressed by refusing external connections by default. Recommendations Upda...