JLSEC-2025-259 LibTIFF 4.3.0 has an out-of-bounds read in `_TIFFmemcpy` in `tif_unix.c` in certain situations...

LibTIFF 4.3.0 has an out-of-bounds read in TIFFmemcpy in tifunix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field...

Siemens SCALANCE and RUGGEDCOM Devices Integer Underflow (Wrap or Wraparound) (CVE-2024-53061)

media: s5p-jpeg: vulnerability due to the possibility of buffer overflows when the variable word is less than 2, which is prevented by adding extra checks. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C...

Microsoft Office Code Execution Vulnerability (CNVD-2026-00027)

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. The product's common components include Word, Excel, Access, Powerpoint, FrontPage, and so on. A code execution vulnerability exists in Microsoft Office, which can be exploited by an attacker to...

Security Updates for Microsoft Office Products C2R (November 2025)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. CVE-2025-62199, CVE-2025-62216 - Use after free in Microsoft Office Word allows an...

CVE-2025-62205

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally...

Malicious code in erick-ronde56-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25b7ddd3dc057145a841e95c581d296ad852c22523353d3dacbec541b0d896b6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Vulnerabilities fixed in Microsoft Office

Microsoft has fixed vulnerabilities in several Office products. A malicious party can exploit the vulnerabilities to grant themselves elevated privileges, execute arbitrary code in the victim's context and gain access to sensitive data. Successful exploitation requires the malicious party to tric...

CVE-2025-62205

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally...

CVE-2025-62205

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally...

EUVD-2025-93403

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally...

Microsoft Office Remote Code Execution Vulnerability

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally...

Microsoft Word 资源管理错误漏洞

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. The product's common components include Word, Excel, Access, Powerpoint, FrontPage, etc.. A code execution vulnerability exists in Microsoft Office, which can be exploited by an attacker to execute...

PT-2025-46500

Name of the Vulnerable Software and Affected Versions Microsoft Office Word affected versions not specified Description A use after free condition exists in Microsoft Office Word. This can allow an unauthorized attacker to execute code locally. The issue involves improper memory management,...

Security Updates for Microsoft Office Products (October 2025) (macOS)

The version of Microsoft Office for Mac installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2025 advisory, including: - Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. CVE-2025-59236 - Use after free i...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989942)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989942 advisory. In the Linux kernel, the following vulnerability has been resolved: xhci: Fix command ring pointer corruption while aborting a command The command ring pointer is...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990099)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990099 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - fix infinite loop on requests not multiple of WORDSZ The commit referenced in...

Security Updates for Microsoft Word Products C2R (October 2025)

The Microsoft Word Products are missing security updates. It is, therefore, affected by multiple remote code execution vulnerabilities that attackers can exploit to bypass authentication and execute unauthorized arbitrary commands. Note that Nessus has not tested for these issues but has instead...

Iran-Linked MuddyWater Targets 100+ Organizations in Global Espionage Campaign

The Iranian nation-state group known as MuddyWater has been attributed to a new campaign that has leveraged a compromised email account to distribute a backdoor called Phoenix to various organizations across the Middle East and North Africa MENA region, including over 100 government entities. The...

CVE-2025-11536

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 8.2.5 via the wpajaximportelementortemplate action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to ma...

Microsoft 365 Word Copilot Spoofing Vulnerability

Microsoft 365 Word Copilot is an AI assistant from Microsoft Corporation, USA. Microsoft 365 Word Copilot has a spoofing vulnerability that can be exploited by attackers to cause spoofing attacks...