PT-2025-44714

Name of the Vulnerable Software and Affected Versions Advanced Ads – Ad Manager & AdSense plugin for WordPress versions prior to 2.0.13 Description The Advanced Ads – Ad Manager & AdSense plugin for WordPress is susceptible to Remote Code Execution through the select one function. The issue stems...

CVE-2025-12380

Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-related IPC calls. This may have been usable to escape the child process sandbox. This vulnerability was fixed in Firefox 144.0.2...

FreeBSD : Firefox -- use-after-free in the GPU or browser process (291773e6-b5b2-11f0-8f61-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 291773e6-b5b2-11f0-8f61-b42e991fc52e advisory. https://bugzilla.mozilla.org/showbug.cgi?id=1993113 reports: Starting with Firefox 142, it was possible...

Malicious code in annotate-pure-calls (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2a9cdca3a9ab53743de2a24b78ebb758510f58ed74ba54d5f727dcfdb17e317 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-36859

Malicious code in annotate-pure-calls npm...

MAL-2025-48984 Malicious code in annotate-pure-calls (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2a9cdca3a9ab53743de2a24b78ebb758510f58ed74ba54d5f727dcfdb17e317 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview annotate-pure-calls is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2025-60542

SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false...

Deserialization of Untrusted Data

Overview keras is a Keras is a high-level neural networks API for Python.. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the .keras archives when they are initialized with a path to a vocabulary file. The model deserialization process when loading the...

CVE-2025-41090

microCLAUDIA in v3.2.0 and prior has an improper access control vulnerability. This flaw allows an authenticated user to perform unauthorized actions on other organizations' systems by sending direct API requests. To do so, the attacker can use organization identifiers obtained through a...

Malicious Package

Overview infobip-calls-showcase is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

AZL-68927 CVE-2025-40075 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: tcpmetrics: use dstdevnetrcu Replace three dstdev with a lockdep enabled helper...

CVE-2025-40075 tcp_metrics: use dst_dev_net_rcu()

In the Linux kernel, the following vulnerability has been resolved: tcpmetrics: use dstdevnetrcu Replace three dstdev with a lockdep enabled helper...

Mozilla Firefox < 144.0.2

The version of Firefox installed on the remote Windows host is prior to 144.0.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2025-86 advisory. - Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser...

PT-2025-44159

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 144.0.2 Description A compromised child process could trigger a use-after-free in the GPU or browser process through WebGPU-related IPC calls. This could potentially allow for escaping the child process sandbox...

Security Vulnerabilities fixed in Firefox 144.0.2 — Mozilla

Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-related IPC calls. This may have been usable to escape the child process sandbox...

Linux Distros Unpatched Vulnerability : CVE-2025-40011

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/gma500: Fix null dereference in hdmi teardown pcisetdrvdata sets the value of pdev-driverdata to NULL, after which the driverdata obtained from the same dev...

CVE-2025-11887 Supervisor <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update

The Supervisor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX functions in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update...

EUVD-2022-54789

In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: Keep MSRRI set when calling RTAS RTAS runs in real mode MSRDR and MSRIR unset and in 32-bit big endian mode MSRSF,LE unset. The change in MSR is done in enterrtas in a relatively complex way, since the MSR value cou...

CVE-2025-11957

Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or approve the temporary access requests of other users and gain unauthorized access to vaults and entries via crafted API requests...