CVE-2025-62646

CVE-2025-62646 affects the Restaurant Brands International assistant platform (through 2025-09-06). Multiple sources describe a vulnerability allowing a remote attacker to review stored audio of conversations between Drive Thru staff and customers. The root cause details are not explicitly provid...

Restaurant Brands International assistant platform 安全漏洞

Restaurant Brands International assistant platform is a restaurant back office platform from Restaurant Brands International. A security vulnerability exists in Restaurant Brands International assistant platform version 2025-09-06 and earlier, which stems from a createToken GraphQL mutation that...

EUVD-2025-34924

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume...

CVE-2025-62648

CVE-2025-62648 affects Restaurant Brands International (RBI) assistant platform versions up to 2025-09-06. The connected CSAF document details multiple vulnerabilities: an unauthenticated account creation path via a signup API, cleartext transmission of passwords in email, a token with administra...

EUVD-2025-34926

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers...

CVE-2025-62646

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers...

Mozilla Firefox and Mozilla Thunderbird Memory Misreference Vulnerability

Mozilla Firefox is an open source web browser.Mozilla Thunderbird is a set of e-mail client software separate from the Mozilla Application Suite. The software supports IMAP, POP mail protocols and HTML mail format. A memory misreference vulnerability exists in Mozilla Firefox and Mozilla...

Windows Local Session Manager DoS

The vulnerability of the Windows Local Session Manager component in Windows operating systems is related to improper validation of the specified data type during input processing. Exploiting this vulnerability can allow an attacker to cause service interruptions from a remote location...

CVE-2025-62648

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume...

CVE-2025-62648: Incorrect Authorization

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume...

EUVD-2025-34828

An out-of-bounds write in VirtIO network device emulation in BitVisor from commit 108df6 2020-05-20 to commit 480907 2025-07-06 allows local attackers to cause a denial of service host hypervisor crash via a crafted PCI configuration space access. Given it's a heap overflow in a privileged...

GHSA-3Q4Q-WQM6-HVF3 Mattermost has a Missing Authorization vulnerability

Mattermost versions 10.10.x = 10.10.2, 10.5.x = 10.5.10, 10.11.x = 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictio...

CVE-2025-10300

The TopBar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the fmenbtopbarsavesettings function. This makes it possible for unauthenticated attackers to update the plugin's settin...

CVE-2025-10141

The Digiseller plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ds' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wi...

CVE-2025-10849

The Felan Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'processpluginactions' function called via an AJAX action in versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to activate ...

Rockwell Automation FactoryTalk Linx

RISK EVALUATION Successful exploitation of these vulnerabilities may allow full access to all files, processes, and system resources. 2. RECOMMENDED PRACTICES CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also...

WordPress plugin Truelysell Core 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blogging sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

CVE-2025-61554

A divide-by-zero error exists in the VirtIO network device emulation of BitVisor (commits 108df6 through 480907 ). This vulnerability allows a local attacker to trigger a denial of service by causing a host hypervisor crash through a crafted PCI configuration space access . To remediate this issu...

Linux fwnet_finish_incoming_packet Heap Buffer Overflow DoS

The vulnerability of the fwnetfinishincomingpacket function in the Linux operating system is related to the use of memory after it has been freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

SMB Clients Windows Unauthorized Access

The vulnerability of SMB clients of Windows operating systems is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow an attacker, working remotely, to gain unauthorized access to protected information...