CVE-2025-12380 Use-after-free in WebGPU internals triggered from a compromised child process

Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-related IPC calls. This may have been usable to escape the child process sandbox. This vulnerability was fixed in Firefox 144.0.2...

CVE-2025-12380

Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-related IPC calls. This may have been usable to escape the child process sandbox. This vulnerability was fixed in Firefox 144.0.2...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a code execution vulnerability that is caused by the use of a WebGPU internal release triggered by an infected child process. An attacker could exploit the vulnerability to...

Figma Developer MCP < 0.6.3 RCE (GHSA-gxw4-4fc5-9gr5)

The remote host has a version of figma-developer-mcp prior to 0.6.3. A command injection vulnerability exists in the figma-developer-mcp MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to childprocess.exec, enabling an attacker to inject arbitrary...

Security Vulnerabilities fixed in Firefox 144.0.2 — Mozilla

Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-related IPC calls. This may have been usable to escape the child process sandbox...

Siemens SIMATIC, SCALANCE and RUGGEDCOM Devices Improper Resource Locking (CVE-2024-47660)

In the Linux kernel, the following vulnerability has been resolved: fsnotify: clear PARENTWATCHED flags lazily In some setups directories can have many usually negative dentries. Hence fsnotifyupdatechilddentryflags function can take a significant amount of time. Since the bulk of this function...

WordPress Child Themes plugin cross-site scripting vulnerability

WordPress Child Themes plugin is mainly used to simplify the creation and management of child themes, through automation tools to help users quickly generate child themes based on the parent theme. A cross-site scripting vulnerability exists in the WordPress Child Themes plugin, which stems from...

CVE-2025-52755

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chris Taylor Child Themes child-themes allows Reflected XSS.This issue affects Child Themes: from n/a through = 1.0.1...

Canada Fines Cybercrime Friendly Cryptomus $176M

Financial regulators in Canada this week levied $176 million in fines against Cryptomus , a digital payments platform that supports dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services. The penalties for violating Canada's anti money-laundering laws come ten months...

EUVD-2025-35480

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chris Taylor Child Themes child-themes allows Reflected XSS.This issue affects Child Themes: from n/a through = 1.0.1...

CVE-2025-52755

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chris Taylor Child Themes child-themes allows Reflected XSS.This issue affects Child Themes: from n/a through = 1.0.1...

CVE-2025-52755 WordPress Child Themes plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chris Taylor Child Themes child-themes allows Reflected XSS.This issue affects Child Themes: from n/a through = 1.0.1...

CVE-2025-52755

CVE-2025-52755 describes a Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Child Themes (component: child-themes ) that allows reflected XSS due to improper input handling during web page generation. Affected versions are listed as through 1.0.1 . The CVE records (NVD/Red Hat/EU ...

CVE-2025-52755 WordPress Child Themes plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chris Taylor Child Themes child-themes allows Reflected XSS.This issue affects Child Themes: from n/a through = 1.0.1...

CVE-2022-50572

In the Linux kernel, the following vulnerability has been resolved: ASoC: audio-graph-card: fix refcount leak of cpuep in graphforeachlink The ofgetnextchild returns a node with refcount incremented, and decrements the refcount of prev. So in the error path of the while loop, ofnodeput needs be...

CVE-2022-50572 ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link()

In the Linux kernel, the following vulnerability has been resolved: ASoC: audio-graph-card: fix refcount leak of cpuep in graphforeachlink The ofgetnextchild returns a node with refcount incremented, and decrements the refcount of prev. So in the error path of the while loop, ofnodeput needs be...

PT-2025-43242

Name of the Vulnerable Software and Affected Versions Chris Taylor Child Themes versions through 1.0.1 Description The software contains a flaw related to improper input handling during web page generation, which can lead to Reflected Cross-Site Scripting XSS. This allows an attacker to inject...

WordPress plugin Child Themes 跨站脚本漏洞

WordPress Child Themes plugin is mainly used to simplify the creation and management of child themes, through automation tools to help users quickly generate child themes based on the parent theme. A cross-site scripting vulnerability exists in the WordPress Child Themes plugin, which stems from...

EUVD-2022-54967

In the Linux kernel, the following vulnerability has been resolved: block: don't delete queue kobject before its children kobjects aren't supposed to be deleted before their child kobjects are deleted. Apparently this is usually benign; however, a WARN will be triggered if one of the child kobjec...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987557)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987557 advisory. In the Linux kernel, the following vulnerability has been resolved: net: altera: Fix refcount leak in alteratsemdiocreate Every iteration of foreachchildofnode...