PT-2025-49528

Name of the Vulnerable Software and Affected Versions ENOVIA Collaborative Industry Innovator versions 3DEXPERIENCE R2022x through 3DEXPERIENCE R2025x Description A reflected Cross-site Scripting XSS issue exists in ENOVIA Collaborative Industry Innovator. This allows an attacker to execute...

Privacy Practices of Browser Agents

This paper presents a systematic evaluation of the privacy behaviors and attributes of eight recent, popular browser agents. Browser agents are software that automate Web browsing using large language models and ancillary tooling. However, the automated capabilities that make browser agents...

Fedora 43 : chromium (2025-3c51a0ed51)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-3c51a0ed51 advisory. Update to 143.0.7499.40 High CVE-2025-13630: Type Confusion in V8 High CVE-2025-13631: Inappropriate implementation in Google Updater High...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google, Inc. in the United States. A security vulnerability exists in Google Android, which stems from an issue with a logic error in the MediaBrowser.java file that could lead to background access rights...

EUVD-2025-201555

Malicious code in ssf-desktop-api-browser npm...

[SECURITY] Fedora 43 Update: chromium-143.0.7499.40-1.fc43

Chromium is an open-source web browser, powered by WebKit Blink...

CVE-2025-34257

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting XSS vulnerability in the /rmm/v1/action/defined endpoint. When an authenticated user creates a task, the definedname value is stored and later rendered in the Overview page without HTML sanitization. An...

Zero-Click Agentic Browser Attack Can Delete Entire Google Drive Using Crafted Emails

A new agentic browser attack targeting Perplexity's Comet browser that's capable of turning a seemingly innocuous email into a destructive action that wipes a user's entire Google Drive contents, findings from Straiker STAR Labs show. The zero-click Google Drive Wiper technique hinges on connecti...

EUVD-2025-201431

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting XSS vulnerability in the /rmm/v1/plugin-config/dashboards/menus endpoint. When an authenticated user adds or edits a dashboard entry, the label and path values are stored in plugin configuration data and...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: azurefile-csi, thanos, docker-cli-fips, ip-masq-agent, redis-operator-fips, nri-apache, seaweedfs-operator-fips, kubernetes-csi-livenessprobe-fips, hydra, nuclei, grafana-operator, rancher-telemetry, tkn-fips, volume-modifier-for-k8s-fips,...

CVE-2025-62223 Microsoft Edge (Chromium-based) for Mac Spoofing Vulnerability

...

Google Chrome Use After Release Vulnerability (CNVD-2026-07245)

Google Chrome is a web browser developed by Google Inc. Google Chrome suffers from a use-after-free vulnerability that stems from Storage objects being accessed even after they have been released prematurely. An attacker could use this vulnerability to trick a user into visiting a specially craft...

PT-2025-49281

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting XSS vulnerability in the /rmm/v1/action/schedule endpoint. When an authenticated user adds a schedule to an existing task, the schedule name is stored and later rendered in schedule listings without HTML...

Microsoft Edge (Chromium) < 143.0.3650.66 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 143.0.3650.66. It is, therefore, affected by multiple vulnerabilities as referenced in the December 4, 2025 advisory. - Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: redka, nri-redis, thanos-operator, newrelic-k8s-metadata-injection, kserve-modelmesh-serving, terraform-mcp-server, kubeflow-pipelines, gitsign, pgpool2exporter, mkcert, opa-envoy, kubernetes-csi-driver-nfs, rancher-fleet, boring-registry, spicedb-operator, spicedb,...

Chromium: CVE-2025-13640 Inappropriate implementation in Passwords

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2025-13632 Inappropriate implementation in DevTools

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2025-13630 Type Confusion in V8

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

WebXR Flaw Hits 4 Billion Chromium Users, Update Your Browser Now

Cybersecurity startup AISLE discovered a Medium severity flaw in the WebXR component of Chrome, Edge, and other Chromium browsers. Over 4 billion devices were at risk. Update now...

Microsoft Edge (Chromium-based) for Mac Spoofing Vulnerability

User interface ui misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network...