firefox: thunderbird: Race condition in the Graphics component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Race condition in the Graphics component...

Important: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

firefox: thunderbird: Race condition in the Graphics component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Race condition in the Graphics component...

PT-2025-48437

Name of the Vulnerable Software and Affected Versions Arm Ltd Valhall GPU Kernel Driver versions r53p0 through r54p1 Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver versions r53p0 through r54p1 Description A Use After Free issue exists in the Arm Ltd Valhall GPU Kernel Driver and Arm Ltd Arm 5...

PT-2025-48541

Name of the Vulnerable Software and Affected Versions Todoist version 8896 Description Todoist version 8896 has a Cross Site Scripting XSS issue in the /api/v1/uploads API endpoint. Uploaded SVG files lack sanitization, allowing embedded JavaScript to execute when a user opens the attachment from...

ARM Valhall GPU Kernel Driver and ARM 5th Gen GPU Architecture Kernel Driver security vulnerabilities

ARM Valhall GPU Kernel Driver and ARM 5th Gen GPU Architecture Kernel Driver are both products of ARM UK.Valhall GPU Kernel Driver is a Valhall GPU kernel driver.ARM 5th Gen GPU Architecture Kernel Driver is a GPU kernel driver. A security vulnerability exists in the ARM Valhall GPU Kernel Driver...

PT-2025-48574

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 2.2.3 Description FileRise is a self-hosted web-based file manager. A stored cross-site scripting XSS issue exists due to improper handling of uploaded SVG files. The application accepts user-supplied SVG uploads...

Todoist security vulnerabilities

Todoist is a task management and to-do list application from Todoist, Inc. A security vulnerability exists in Todoist version v8896, which stems from a lack of cleanup of uploaded SVG files in /api/v1/uploads, which could lead to a cross-site scripting attack...

Imagination Graphics DDK security vulnerability

Imagination Graphics DDK is a suite of GPU driver tools from Imagination UK. A security vulnerability exists in the Imagination Graphics DDK, which originates from the possibility that an unprivileged user may trigger a GPU system call to read stale data, potentially resulting in a kernel excepti...

ALSA-2025:22394 Moderate: qt6-qtsvg security update

Scalable Vector Graphics SVG is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices. Security Fixes: qtsvg: Uncontrolled recursion in Qt SVG module CVE-2025-10728 For more details...

ARM Valhall GPU Kernel Driver and ARM 5th Gen GPU Architecture Kernel Driver security vulnerabilities

ARM Valhall GPU Kernel Driver and ARM 5th Gen GPU Architecture Kernel Driver are both products of ARM UK.Valhall GPU Kernel Driver is a Valhall GPU kernel driver.ARM 5th Gen GPU Architecture Kernel Driver is a GPU kernel driver. A security vulnerability exists in the ARM Valhall GPU Kernel Driver...

ALSA-2025:22363 Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox: Mitigation bypass in the DOM: Security component CVE-2025-13018 firefox: Use-after-free in the Audio/Video component CVE-2025-13014 firefox: Incorrect boundary...

PT-2025-48439

Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger reads of stale data that can lead to kernel exceptions and write use-after-free. The Use After Free common weakness enumeration was chosen as the stale data can include handles to resources in whi...

SROOT Component Unauthorized Access

The vulnerability of the SROOT component in NVIDIA’s DGX OS workstation operating system for DGX Spark AI systems is related to improper behavior. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information or cause service failures...

yungifez Skuul School Management System vulnerable to XSS via SVG

A weakness has been identified in yungifez Skuul School Management System up to 2.6.5. This vulnerability affects unknown code of the file /dashboard/schools/1/edit of the component SVG File Handler. This manipulation causes cross site scripting. The attack is possible to be carried out remotely...

Cross-site Scripting (XSS)

Overview yungifez/skuul is an A multi school management system. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the application, which uploaded SVG files directly without sanitization or enforcing content-type restrictions. An attacker can inject and execute...

SROOT Component Unauthorized Access

The vulnerability of the SROOT component in NVIDIA DGX OS workstations for AI systems, such as DGX Spark, is related to errors in boundary removal of critical data. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...

CVE-2025-13692

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2025-59820

A flaw was found in Krita. This vulnerability allows a heap-based buffer overflow via loading a manipulated TGA Truevision Graphics Adapter file...

EUVD-2025-199832

ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting XSS vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if t...