Firefox -- Sandbox escape

[email protected] reports: Sandbox excape due to integer overflow in the Graphics: Canvas2D component...

Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in Apache XML Graphics FOP (CVE-2024-28168)

Summary A vulnerability in Apache XML Graphics FOP that is used by IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2024-28168 DESCRIPTION: Improper Restriction of XML External Entity Reference 'XXE' vulnerability in Apache XML Graphics FOP. This issue affects Apac...

Microsoft Flags AI-Driven Phishing: LLM-Crafted SVG Files Outsmart Email Security

Microsoft is calling attention to a new phishing campaign primarily aimed at U.S.-based organizations that has likely utilized code generated using large language models LLMs to obfuscate payloads and evade security defenses. "Appearing to be aided by a large language model LLM, the activity...

Linux Distros Unpatched Vulnerability : CVE-2025-23274

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NVIDIA nvJPEG contains a vulnerability in jpeg encoding where a user may cause an out-of-bounds read by providing a maliciously crafted input image with...

SVG Security Analysis Toolkit

SVG Security Analysis Toolkit contains specialized Python tools for analyzing potentially malicious SVG files and detecting security mechanisms...

The vulnerability of components such as drivers, GPU, DRM, and XE in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the drivers/gpu/drm/xe components of the Linux operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure...

Researchers Expose Phishing Threats Distributing CountLoader and PureRAT

A new campaign has been observed impersonating Ukrainian government agencies in phishing attacks to deliver CountLoader , which is then used to drop Amatera Stealer and PureMiner. "The phishing emails contain malicious Scalable Vector Graphics SVG files designed to trick recipients into opening...

CVE-2025-11027 givanz Vvveb SVG File cross site scripting

A vulnerability was identified in givanz Vvveb up to 1.0.7.2. Affected by this issue is some unknown functionality of the component SVG File Handler. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. Once aga...

Malicious code in com.unity.test-framework.graphics.performance (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-47642 Malicious code in com.unity.test-framework.graphics.performance (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-59525

Horilla is a free and open source Human Resource Management System HRMS. Prior to version 1.4.0, improper sanitization across the application allows XSS via uploaded SVG and via allowed , which can be chained to execute JavaScript whenever users view impacted content e.g., announcements. This can...

CVE-2025-10909

A security flaw has been discovered in Mangati NovoSGA up to 2.2.9. The impacted element is an unknown function of the file /admin of the component SVG File Handler. Performing manipulation of the argument logoNavbar/logoLogin results in cross site scripting. Remote exploitation of the attack is...

New SVG-based phishing campaign is a recipe for disaster

We've written in the past about cybercriminals using SVG files for phishing and for clickjack campaigns. We found a new, rather sophisticated example of an SVG involved in phishing. For readers that missed the earlier posts, SVG files are not always simply image files. Because they are written in...

Nextcloud: Stored XSS Vulnerability via SVG File

A stored XSS vulnerability was discovered in Nextcloud related to the handling of SVG files. The vulnerability allowed the execution of arbitrary JavaScript code...

USN-7774-2 linux-aws-fips, linux-fips, linux-gcp-fips vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - PowerPC architecture; - x86 architecture; - ACPI drivers; - Serial ATA and Parallel ATA...

drm/vc4: don't check if plane->state->fb == state->fb

...

drm/amd/pm: fix a potential gpu_metrics_table memory leak

...

CVE-2025-59525 Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover

Horilla is a free and open source Human Resource Management System HRMS. Prior to version 1.4.0, improper sanitization across the application allows XSS via uploaded SVG and via allowed , which can be chained to execute JavaScript whenever users view impacted content e.g., announcements. This can...

CVE-2025-10909

Mangati NovoSGA (versions up to 2.2.9) is affected by a Cross-site Scripting (XSS) vulnerability in the SVG File Handler, specifically via manipulation of the logoNavbar/logoLogin arguments in the /admin path. The issue can be exploited remotely; multiple sources report that the exploit is public...

CVE-2025-10502

CVE-2025-10502 is a heap buffer overflow in ANGLE used by Google Chrome/Chromium. The vulnerability affects Chrome builds prior to 140.0.7339.185, with potential remote heap corruption triggered by malicious network traffic. Reported in multiple advisories and a Chrome release note (stable channe...