Mozilla -- Use-after-free

https://bugzilla.mozilla.org/showbug.cgi?id=1992760 reports: Use-after-free in the WebRTC: Signaling component...

EUVD-2025-201752

In multiple locations, there is a possible way for an application on a work profile to set the main user's default NFC payment setting due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed...

CVE-2025-48612

In setDefaultKey of DefaultPaymentSettings.java, there is a possible way for an application to set the main user's default NFC payment setting due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not...

CVE-2025-48612

In setDefaultKey of DefaultPaymentSettings.java, there is a possible way for an application to set the main user's default NFC payment setting due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not...

CVE-2025-48612

CVE-2025-48612 affects Android work-profile contexts where an app can alter the main user's NFC payment default due to improper input validation at multiple locations. The root cause is input validation issues that enable a local escalation of privilege without additional execution privileges or ...

MAL-2025-192377 Malicious code in gs-uitk-lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2de2e606bc9fde8de540caf63cbded837e1bbbd7bc6bd2d477e38dcf89a76f0b The package gs-uitk-lodash was found to contain malicious code. Source: ossf-package-analysis...

tipc: Fix use-after-free in tipc_mon_reinit_self().

...

MAL-2025-192356 Malicious code in fdir5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e6863b32353d63e9eecdc0ff2ce31db470ed49deb7ccdee067795e37e92bb72 The package fdir5 was found to contain malicious code. Source: ossf-package-analysis 5fbb878466820a17ee68843707334225006abad5203a6e4fbc61130d466028bc...

MAL-2025-192353 Malicious code in fdir1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ba081e2ca3fffe519e73fc13330df7332fbaf118aa8f6c193b43e9b2ce8a5ce The package fdir1 was found to contain malicious code. Source: ossf-package-analysis 8f5aefdb4168145eaa4b092c9e5f4fbd482f9fbd1fc0328b3272f3e2067731e8...

CVE-2025-66562 TUUI vulnerable to Remote Code Execution (RCE) via XSS in Markdown ECharts Rendering

TUUI is a desktop MCP client designed as a tool unitary utility integration. Prior to 1.3.4, a critical Remote Code Execution RCE vulnerability exists in Tuui due to an unsafe Cross-Site Scripting XSS flaw in the Markdown rendering component. Tuui allows the execution of arbitrary JavaScript with...

CVE-2025-66562 TUUI vulnerable to Remote Code Execution (RCE) via XSS in Markdown ECharts Rendering

TUUI is a desktop MCP client designed as a tool unitary utility integration. Prior to 1.3.4, a critical Remote Code Execution RCE vulnerability exists in Tuui due to an unsafe Cross-Site Scripting XSS flaw in the Markdown rendering component. Tuui allows the execution of arbitrary JavaScript with...

CVE-2025-66562 TUUI vulnerable to Remote Code Execution (RCE) via XSS in Markdown ECharts Rendering

TUUI is a desktop MCP client designed as a tool unitary utility integration. Prior to 1.3.4, a critical Remote Code Execution RCE vulnerability exists in Tuui due to an unsafe Cross-Site Scripting XSS flaw in the Markdown rendering component. Tuui allows the execution of arbitrary JavaScript with...

CVE-2025-6666

A vulnerability was determined in motogadget mo.lock Ignition Lock up to 20251125. Affected by this vulnerability is an unknown functionality of the component NFC Handler. Executing manipulation can lead to use of hard-coded cryptographic key . The physical device can be targeted for the attack. ...

CVE-2025-66222

DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting XSS vulnerability in the Mermaid diagram renderer allows an attacker to execute arbitrary JavaScript within the application context. By leveraging the exposed Electron IPC...

EUVD-2025-201193

In the Linux kernel, the following vulnerability has been resolved: be2net: pass wrbparams in case of OS2BMC beinsertvlaninpkt is called with the wrbparams argument being NULL at besendpkttobmc call site. This may lead to dereferencing a NULL pointer when processing a workaround for specific...

EUVD-2025-201221

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix IPsec cleanup over MPV device When we do mlx5edetachnetdev we eventually disable blocking events notifier, among those events are IPsec MPV events from IB to core. So before disabling those blocking events, make sur...

Malicious code in elf-stats-ginger-wreath-646 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0736ed9611847ba4c5416cd0bd8ba33bae114769eec8947e7d58c85c3ce100c1 The package elf-stats-ginger-wreath-646 was found to contain malicious code. Source: ossf-package-analysis...

Johnson Controls iSTAR

RISK EVALUATION Successful exploitation of this vulnerability could result in the product failing to re-establish communication once the certificate expires. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such...

CVE-2025-65842

The Aquarius HelperTool 1.0.003 privileged XPC service on macOS contains multiple flaws that allow local privilege escalation. The service accepts XPC connections from any local process without validating the client's identity, and its authorization logic incorrectly calls AuthorizationCopyRights...

Malicious code in elf-stats-twinkling-ribbon-344 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a4c9eb38abc668e7c9332e8d230efe3435594c7d8d0b82695d2cfcbdb087a93 The package elf-stats-twinkling-ribbon-344 was found to contain malicious code. Source: ossf-package-analysis...