CVE-2025-27794

Flarum is open-source forum software. A session hijacking vulnerability exists in versions prior to 1.8.10 when an attacker-controlled authoritative subdomain under a parent domain e.g., subdomain.host.com sets cookies scoped to the parent domain .host.com. This allows session token replacement f...

CVE-2025-25245

CVE-2025-25245 affects SAP BusinessObjects BI Platform (Web Intelligence). A deprecated web application endpoint that is not properly secured allows injection of a malicious URL via data returned to the user, enabling cross-site scripting within the victim’s browser. Impacts are limited to confid...

CVE-2025-0062 Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)

SAP BusinessObjects Business Intelligence Platform allows an attacker to inject JavaScript code in Web Intelligence reports. This code is then executed in the victim's browser each time the vulnerable page is visited by the victim. On successful exploitation, an attacker could cause limited impac...

firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume...

firefox: Unexpected GC during RegExp bailout processing

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was not expecting it...

Stable Channel Update for Desktop

The Stable channel has been updated to 134.0.6998.88/.89 for Windows, Mac and 134.0.6998.88 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. Extended stable channel has been updated to 134.0.6998.89 for Win/Mac and will roll o...

PT-2025-9743 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 134.0.6998.35 Description: The issue is related to an inappropriate implementation in Permission Prompts in Google Chrome, allowing an attacker who convinced a user to install a malicious extension to perform U...

Linux Distros Unpatched Vulnerability : CVE-2020-16019

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inappropriate implementation in filesystem in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process ...

Linux Distros Unpatched Vulnerability : CVE-2010-3770

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multiple cross-site scripting XSS vulnerabilities in the rendering engine in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11,...

CVE-2025-1748

CVE-2025-1748 affects OpenCart versions prior to 4.1.0. The flaw is an HTML injection in the /account/register flow that lets an attacker modify the HTML rendered in a victim’s browser via a malicious URL (by altering the parameter name). Reported across multiple feeds, the vulnerability is categ...

CVE-2025-25300 smartbanner.js rel noopener XSS vulnerability

smartbanner.js is a customizable smart app banner for iOS and Android. Prior to version 1.14.1, clicking on smartbanner View link and navigating to 3rd party page leaves window.opener exposed. It may allow hostile third parties to abuse window.opener, e.g. by redirection or injection on the...

The vulnerability in the user interfaces of Google Chrome and Microsoft Edge allows a hacker to gain access to read, modify, and delete data.

The vulnerability in the user interfaces of Google Chrome and Microsoft Edge relates to improper security checks for standard elements. Exploiting this vulnerability can allow an attacker to gain access to, read, modify, and delete data...

RHEL 9 : firefox (RHSA-2025:1138)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:1138 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox:...

Updated chromium-browser-stable packages fix security vulnerability

Use after free in DevTools. CVE-2025-0762...

MGASA-2025-0020 Updated chromium-browser-stable packages fix security vulnerabilities

Lot of CVEs were fixed by upstream since our current version; please see the links...

Updated chromium-browser-stable packages fix security vulnerabilities

Lot of CVEs were fixed by upstream since our current version; please see the links...

Chromium: CVE-2025-0439 Race in Frames

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

USN-7201-1: WebKitGTK vulnerabilities

Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2025-02452)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

CVE-2024-54049

Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser...