Firefox Patches 2 Zero-Days Exploited at Pwn2Own Berlin with $100K in Rewards

Mozilla has released security updates to address two critical security flaws in its Firefox browser that could be potentially exploited to access sensitive data or achieve code execution. The vulnerabilities, both of which were exploited as a zero-day at Pwn2Own Berlin, are listed below -...

PT-2025-22082

Name of the Vulnerable Software and Affected Versions OpenPGP.js versions 5.0.1 through 5.11.2 OpenPGP.js versions 6.0.0 through 6.1.0 Description A maliciously modified message can be passed to either openpgp.verify or openpgp.decrypt, causing these functions to return a valid signature...

USN-7513-2: Linux kernel (Real-time) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - RISC-V architecture; - x86 architecture; - Block layer subsystem; - Compute Acceleration Framework; - ACPI drivers;...

USN-7513-1: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - RISC-V architecture; - x86 architecture; - Block layer subsystem; - Compute Acceleration Framework; - ACPI drivers;...

USN-7511-1 linux-gcp vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - PowerPC architecture; - x86 architecture; - Block layer subsystem; - Network block device...

USN-7510-2: Linux kernel (FIPS) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - PowerPC architecture; - x86 architecture; - Block layer subsystem; - Network block device...

Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-7510-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7510-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update...

The vulnerability of the Tenda RX2 Pro router’s microprogramming-based management service allows a hacker to execute arbitrary commands.

The vulnerability of the Tenda RX2 Pro router’s microprogrammed management service is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by sending specially crafted UDP packets...

CVE-2024-12767

The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts...

GHSA-7MM3-VFG8-7RG6 Babylon Finality Provider `MsgCommitPubRandList` replay attack

Summary A high vulnerability exists in the Babylon protocol's x/finality module due to a lack of domain separation in signed messages, combined with insufficient validation in the MsgCommitPubRandList handler. Specifically, the handler does not enforce that the submitted Commitment field is 32...

GHSA-R7R2-M3VR-C8QC Mattermost Fails to Validate Team Invite Permissions

Mattermost versions 10.6.x = 10.6.1, 10.5.x = 10.5.2, 10.4.x = 10.4.4, 9.11.x = 9.11.11 fail to check the correct permissions which allows authenticated users who only have permission to invite non-guest users to a team to add guest users to that team via the API to add a single user to a team...

Security Bulletin: Multiple Vulnerabilities in IBM Event Streams

Summary Multiple vulnerabilities were addressed in IBM Event Streams version 11.7.0. Vulnerability Details CVEID:CVE-2024-52798 DESCRIPTION: path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cau...

Patch Tuesday, May 2025 Edition

Microsoft on Tuesday released software updates to fix at least 70 vulnerabilities in Windows and related products, including five zero-day flaws that are already seeing active exploitation. Adding to the sense of urgency with this month's patch batch from Redmond are fixes for two other weaknesse...

Vulnerabilities fixed in Adobe ColdFusion

Adobe has fixed vulnerabilities in ColdFusion Versions 2025.1, 2023.13, 2021.19 and earlier. The vulnerabilities are in the way ColdFusion handles input validation and authorization. Highly privileged attackers can execute arbitrary code without user interaction, which can lead to unauthorized...

The vulnerability of the /goform/formSetPassword function in D-Link’s DIR-618 and DIR-605L router microprogramming software allows a hacker to execute arbitrary code.

The vulnerability of the /goform/formSetPassword function in D-Link DIR-618 and DIR-605L router microprogramming systems is related to access control errors. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Alibaba Cloud Linux 3 : 0042: cloud-kernel bugfix, enhancement and (ALINUX3-SA-2023:0042)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2023:0042 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2021-33061: Insufficient control flow...

Alibaba Cloud Linux 3 : 0155: curl (ALINUX3-SA-2022:0155)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0155 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2022-32206: curl 7.84.0 supports chain...

The vulnerability of D-Link DIR-859 router’s microprogramming software, related to deficiencies in authentication procedures, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of D-Link DIR-859 router microprogramming software is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of D-Link DIR-618 and DIR-605L router microprogramming software allows a hacker to execute arbitrary code.

The vulnerability of D-Link DIR-618 and DIR-605L router microprogramming software is related to access control errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the /goform/formVirtualServ function in D-Link DIR-618 and DIR-605L router microprogramming software allows a hacker to execute arbitrary code.

The vulnerability of the /goform/formVirtualServ function in D-Link DIR-618 and DIR-605L router microprogramming systems is related to access control errors. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...