Important: kernel6.12

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: netsched: Flush gsoskb list too during -change CVE-2025-37992 In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: fix race condition in unaccepted memory handling CVE-2025-38008 In th...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that originates from an attempt to recycle a poisoned page in x86/sgx, which could result in a machine check...

GnuTLS 信任管理问题漏洞

GnuTLS is a free secure communications library for implementing the SSL, TLS and DTLS protocols from the GnuTLS open source. A trust management issue vulnerability exists in GnuTLS that stems from improper handling of CT SCT extensions when resolving X.509 certificates, which could lead to...

Medium: tigervnc

Issue Overview: A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash. CVE-2025-49175 A flaw was found in the Big Requests extension. The reque...

Millions of people spied on by malicious browser extensions in Chrome and Edge

Researchers have discovered a campaign that tracked users’ online behavior using 18 browser extensions available in the official Chrome and Edge webstores. The total number of installs is estimated to be over two million. These extensions offered functionality, received good reviews, touted...

Malicious code in @bosch-rollouts-extensions/soup (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 03bf5cb8a8241befda2ac9e7228f23b30a5160b0bd759c8887503d7a6b6cbb7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Important: Red Hat Security Advisory: tigervnc security update

An update for tigervnc is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support EXTENSION. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the search bar process when page descriptions are inserted into raw HTML without proper sanitization. An attacker can execute arbitrary JavaScript in the context of another user by injecting malicious conten...

CVE-2025-53501

The CVE-2025-53501 issue affects the Mediawiki Scribunto Extension (Wikimedia Foundation). The root cause is improper access control that allows accessing functionality not properly constrained by authorization. Affected versions include Scribunto 1.39.x before 1.39.12, 1.42.x before 1.42.7, and ...

Over 40 Malicious Firefox Extensions Target Cryptocurrency Wallets, Stealing User Assets

Cybersecurity researchers have uncovered over 40 malicious browser extensions for Mozilla Firefox that are designed to steal cryptocurrency wallet secrets, putting users' digital assets at risk. "These extensions impersonate legitimate wallet tools from widely-used platforms such as Coinbase,...

StarCitizenTools Mediawiki Extensions ShortDescription 跨站脚本漏洞

StarCitizenTools Mediawiki Extensions ShortDescription is a StarCitizenTools open source extension with wiki projects. A cross-site scripting vulnerability exists in StarCitizenTools Mediawiki Extensions ShortDescription version 4.0.0, which stems from a short description not being cleaned up...

New Flaw in IDEs Like Visual Studio Code Lets Malicious Extensions Bypass Verified Status

A new study of integrated development environments IDEs like Microsoft Visual Studio Code, Visual Studio, IntelliJ IDEA, and Cursor has revealed weaknesses in how they handle the extension verification process, ultimately enabling attackers to execute malicious code on developer machines. "We...

CVE-2025-53339

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in devnex Devnex Addons For Elementor devnex-addons-for-elementor allows PHP Local File Inclusion.This issue affects Devnex Addons For Elementor: from n/a through = 1.0.9...

PT-2025-44690

Name of the Vulnerable Software and Affected Versions Google Chrome affected versions not specified Description A flaw exists in Google Chrome that could allow attackers to impact the system. This issue involves a policy bypass within Extensions. Microsoft Edge, being Chromium-based, is also...

Malicious code in typing-extensions-plus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 78c15498f688e49c1d6a8b369eae95e0e77016cd05d74f89a72fa9e845c71da5 Importing the module starts code responsible of exfiltrating crypto tokens and API keys. Package imitates typing-extensions --- Category: MALICIOUS - The...

MAL-2025-191914 Malicious code in typing-extensions-plus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 78c15498f688e49c1d6a8b369eae95e0e77016cd05d74f89a72fa9e845c71da5 Importing the module starts code responsible of exfiltrating crypto tokens and API keys. Package imitates typing-extensions --- Category: MALICIOUS - The...

CVE-2025-6381

The BeeTeam368 Extensions plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the handleremovetempfile function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of...

CVE-2025-6381

The BeeTeam368 Extensions plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the handleremovetempfile function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of...

CVE-2025-6379

The BeeTeam368 Extensions Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the handlelivefn function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the...

CVE-2025-6379

The BeeTeam368 Extensions Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the handlelivefn function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the...