CVE-2025-43230

CVE-2025-43230 affects Apple platforms (iPadOS, iOS, macOS Sequoia, watchOS, visionOS, tvOS) with an issue that could allow an app to access user-sensitive data. The vulnerability is addressed by fixes in iPadOS 17.7.9, iPadOS 18.6, iOS 18.6, macOS Sequoia 15.6, tvOS 18.6, watchOS 11.6, and visio...

CVE-2025-43246

CVE-2025-43246 affects macOS Sequoia 15.6 and macOS Sonoma 14.7.7. The issue, addressed with improved checks, could allow an app to access sensitive user data (confidentiality impact high) via a local attack requiring user interaction. Root causes and specific vulnerable components are not detail...

CVE-2025-43193

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to cause a denial-of-service...

CVE-2025-43184

This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. A shortcut may be able to bypass sensitive Shortcuts app settings...

CVE-2016-15045

A local privilege escalation flaw was found in the deepin-daemon lastore-daemon. This flaw allows the creation of a privileged user when a crafted .deb package with a malicious post-install script is provided. The system must permit the installation of unsigned packages for this flaw to be...

CVE-2025-54121

A denial of service flaw was found in the Starlette ASGI framework. This flaw allows a remote attacker to submit a specially crafted multi-part form with large files. This can exhaust the server's resources, which may block the main thread pool and lead to a denial of service. Mitigation Mitigati...

CVE-2025-48965

A flaw was found in mbedtls. The mbedtlsasn1storenameddata function experiences a NULL pointer dereference when val.p is NULL while val.len is greater than zero, leading to a potential crash. This flaw allows a network-based attacker to trigger this condition, resulting in a denial of service...

CVE-2025-53644

A heap buffer write flaw was found in OpenCV. This vulnerability could result in arbitrary memory overwrites and code execution within the context of a program using OpenCV. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

CVE-2025-40924

A session id generation flaw has been discovered in the Catalyst::Plugin::Session Perl module. The session id is generated from a hash usually SHA-1 of a simple counter, the epoch time, the built-in rand function, the PID, and the current Catalyst context. This information is of low entropy. The...

CVE-2025-7026

creationtimestamp| type| source ---|---|--- 2025-07-14 13:12:09+00:00| seen| https://bsky.app/profile/brianhaddock.bsky.social/post/3ltwho4bzyf2a 2025-07-14 13:45:03+00:00| seen| https://t.me/truesecator/7227 2025-07-15 14:29:23+00:00| seen| https://t.me/SEReborn/5756 2025-07-16 17:11:08+00:00|...

CVE-2025-38239

In the Linux kernel, the following vulnerability has been resolved: scsi: megaraidsas: Fix invalid node index On a system with DRAM interleave enabled, out-of-bound access is detected: megaraidsas 0000:3f:00.0: requested/available msix 128/128 pollqueue 0 ------------ cut here ------------ UBSAN:...

CVE-2025-49826

A denial of service flaw was found in Next.js. In certain situations, this issue may lead to an HTTP 204 response being cached for static pages, which can result in the 204 response being provided to all users trying to access the page. Mitigation Mitigation for this issue is either not available...

CVE-2025-38129

In the Linux kernel, the following vulnerability has been resolved: pagepool: Fix use-after-free in pagepoolrecycleinring syzbot reported a uaf in pagepoolrecycleinring: BUG: KASAN: slab-use-after-free in lockrelease+0x151/0xa30 kernel/locking/lockdep.c:5862 Read of size 8 at addr ffff8880286045a...

CVE-2025-6554

A flaw was found in chromium. A type confusion vulnerability in the V8 JavaScript engine allows a remote attacker to achieve arbitrary read and write operations via a specially crafted HTML page. This allows an attacker to potentially manipulate memory contents. The exploitation vector involves t...

CVE-2025-5564

creationtimestamp| type| source ---|---|--- 2025-06-26 02:50:32+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19553 2025-06-26 08:34:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lsipquolym2r...

CVE-2025-6428

When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks. This bug only affects Firefox for Android. Other versions of Firefox are unaffected. This vulnerability affects Firefox 140...

CVE-2025-6432

When Multi-Account Containers was enabled, DNS requests could have bypassed a SOCKS proxy when the domain name was invalid or the SOCKS proxy was not responding. This vulnerability was fixed in Firefox 140 and Thunderbird 140...

CVE-2022-50061

In the Linux kernel, the following vulnerability has been resolved: pinctrl: nomadik: Fix refcount leak in nmkpinctrldtsubnodetomap ofparsephandle returns a node pointer with refcount incremented, we should use ofnodeput on it when not need anymore. Add missing ofnodeput to avoid refcount leak."...

CVE-2025-50182 urllib3 does not control redirects in browsers and Node.js

urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means...

CVE-2022-50130 staging: fbtft: core: set smem_len before fb_deferred_io_init call

In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: core: set smemlen before fbdeferredioinit call The fbtftframebufferalloc calls fbdeferredioinit before initializing info-fix.smemlen. It is set to zero by the framebufferalloc function. It will trigger a WARNON at...