EUVD-2025-131923

A maliciously crafted JPG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process...

CVE-2025-60721

Privilege context switching error in Windows Administrator Protection allows an authorized attacker to elevate privileges locally...

CVE-2025-61832

InDesign Desktop versions 20.5, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path

A use-after-free vulnerability exists in the linux kernel such that the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock...

CVE-2025-40164 usbnet: Fix using smp_processor_id() in preemptible code warnings

In the Linux kernel, the following vulnerability has been resolved: usbnet: Fix using smpprocessorid in preemptible code warnings Syzbot reported the following warning: BUG: using smpprocessorid in preemptible 00000000 code: dhcpcd/2879 caller is usbnetskbreturn+0x74/0x490...

CVE-2025-40125

In the Linux kernel, the following vulnerability has been resolved: blk-mq: check kobject stateinsysfs before deleting in blkmqunregisterhctx In blkmqupdatenrhwqueues the return value of blkmqsysfsregisterhctxs is not checked. If sysfs creation for hctx fails, later changing the number of hwqueue...

CVE-2025-61261

A reflected cross-site scripting XSS vulnerability has been identified in CKeditor allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload...

Malicious code in firebase-io-webdriverio-react-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e905a337a5a8d66d4416fd0b63bf9a60bd94e7bf2c351c452500768ec80639ee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

dm-bufio: don't schedule in atomic context

...

📄 Windows Server Update Service Deserialization Remote Code Execution

This Metasploit module exploits a deserialization vulnerability in the legacy serialization mechanism in Windows Server Update Services WSUS. The vulnerability allows an unauthenticated attacker to create a specially crafted event, which triggers an unsafe deserialization upon server...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-990801)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990801 advisory. In the Linux kernel, the following vulnerability has been resolved: tcp: tcpmakesynack can be called from process context tcprtxsynack now could be called in process...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-990784)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990784 advisory. In the Linux kernel, the following vulnerability has been resolved: firmware: xilinx: don't make a sleepable memory allocation from an atomic context The following...

CVE-2025-63645

CVE-2025-63645 is a stored XSS in pH7Software pH7-Social-Dating-CMS 17.9.1, affecting the messaging system where unsanitized message content is persisted and later rendered in Inbox view without proper encoding, allowing attacker-controlled content to execute in a recipient’s browser. Public docs...

CVE-2025-61839

Format Plugins versions 1.1.1 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user...

CVE-2025-61819

Photoshop Desktop versions 26.8.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2025-60721

Privilege context switching error in Windows Administrator Protection allows an authorized attacker to elevate privileges locally...

CVE-2025-60721

Privilege context switching error in Windows Administrator Protection allows an authorized attacker to elevate privileges locally...

EUVD-2025-93393

Privilege context switching error in Windows Administrator Protection allows an authorized attacker to elevate privileges locally...

CVE-2025-61820

Adobe Illustrator is affected by a Heap-based Buffer Overflow vulnerability (CVE-2025-61820) in versions 28.7.10 through 29.8.2 and earlier. The issue could allow arbitrary code execution in the context of the current user and requires user interaction (victim must open a malicious file). Affecte...

Redis: Redis: Authenticated users can execute LUA scripts as a different user

A code injection vulnerability in Redis Lua scripting where an authenticated user can craft a Lua script to manipulate objects and potentially execute code in another user’s context...