Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the Extensions API in Google Chrome prior to 133.0.6943.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Medium...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: In the slab mechanism, ensure that slab-objexts is cleared in a newly allocated slab page. Ktest recently reported crashes while running several buffered I/O tests. The cause of the crashes was the alloctaggingslaballochook...

Google ChromeOS 安全漏洞

Google ChromeOS is a Linux kernel-based operating system developed by Google. Google ChromeOS suffers from a privilege issue vulnerability. The vulnerability stems from a privilege bypass in extension management, which can be exploited by an attacker to disable extensions on ChromeOS and access...

CVE-2025-49579 Citizen allows stored XSS in menu heading message

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. All system messages in menu headings using the Menu.mustache template are inserted as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group h...

GHSA-RRR2-JCR8-7Q3X @nx/azure-cache Vulnerable to Build Cache Poisoning via Untrusted Pull Requests

A critical security vulnerability exists in remote cache extensions for common build systems utilizing bucket-based remote cache such as those using Amazon S3, Google Cloud Storage, or similar object storage that allows any contributor with pull request privileges to inject compromised artifacts...

CVE-2025-36852 Build Cache Poisoning via Untrusted Pull Requests

A critical security vulnerability exists in remote cache extensions for common build systems utilizing bucket-based remote cache such as those using Amazon S3, Google Cloud Storage, or similar object storage that allows any contributor with pull request privileges to inject compromised artifacts...

Malicious code in chimera-sandbox-extensions (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9b87170278a2bed3680592ca4efa2d402a56ee044fcfea4b95831e545431a794 When started, the code attempts to access multiple domains based on the generating algorithm. Once one valid is found, it downloads a script and executes it. T...

MAL-2025-191701 Malicious code in chimera-sandbox-extensions (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9b87170278a2bed3680592ca4efa2d402a56ee044fcfea4b95831e545431a794 When started, the code attempts to access multiple domains based on the generating algorithm. Once one valid is found, it downloads a script and executes it. T...

Popular Chrome Extensions Found Leaking Data via Unencrypted Connections

Popular Chrome extensions exposed user data by sending it over unencrypted HTTP, raising privacy concerns. Symantec urges caution for users...

OESA-2025-1588 microcode_ctl security update

This is a tool to transform and deploy microcode update for x86 CPUs. Security Fixes: Improper conditions check in some IntelR XeonR processor memory controller configurations when using IntelR SGX may allow a privileged user to potentially enable escalation of privilege via local...

OESA-2025-1589 microcode_ctl security update

This is a tool to transform and deploy microcode update for x86 CPUs. Security Fixes: Improper conditions check in some IntelR XeonR processor memory controller configurations when using IntelR SGX may allow a privileged user to potentially enable escalation of privilege via local...

Microsoft VP9 Video Extensions RCE Vulnerability (Jun 2025) - Windows

Microsoft VP9 Video Extensions is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Synthetic Tabular Data: Methods, Attacks and Defenses

Synthetic data is often positioned as a solution to replace sensitive fixed-size datasets with a source of unlimited matching data, freed from privacy concerns. There has been much progress in synthetic data generation over the last decade, leveraging corresponding advances in machine learning an...

Popular Chrome Extensions Leak API Keys, User Data via HTTP and Hard-Coded Credentials

Cybersecurity researchers have flagged several popular Google Chrome extensions that have been found to transmit data in HTTP and hard-code secrets in their code, exposing users to privacy and security risks. "Several widely used extensions ... unintentionally transmit sensitive data over simple...

Improper File Validation

umbraco.cms is vulnerable to improper file validation. The vulnerability is due to insufficient checks on uploaded file extensions, allowing bypass of configured restrictions via manipulated API requests...

BIT-JOOMLA-2024-27186 [20240803] - Core - XSS in HTML Mail Templates

The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions...

Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads

Impact Via a manipulated API request it's possible to upload a file that doesn't adhere with the configured allowable file extensions. Patches Patched in 15.4.2 and 16.0.0. Workarounds None available...

GO-2025-3732 GitHub CLI and extensions can execute arbitrary commands on compromised GitHub Enterprise Server in github.com/cli/go-gh

GitHub CLI and extensions can execute arbitrary commands on compromised GitHub Enterprise Server in github.com/cli/go-gh...

Umbraco 代码问题漏洞

Umbraco is an open source content management system CMS written in C from Umbraco, Denmark. A code issue vulnerability exists in Umbraco versions prior to 14.0.0 through 15.4.2 and prior to 16.0.0, which stems from the ability to upload files that do not match the configured allowable file...

Security update for postgresql, postgresql16, postgresql17

This update for postgresql, postgresql16, postgresql17 fixes the following issues: This update ships postgresql17 , and fixes security issues with postgresql16: bsc1230423: Relax the dependency of extensions on the server version from exact major.minor to greater or equal, after Tom Lane confirme...