CVE-2025-7656

CVE-2025-7656 affects Google Chrome’s V8 engine prior to 138.0.7204.157, where an integer overflow can lead to heap corruption via a crafted HTML page. The vulnerability is categorized as High severity with network attack potential and user interaction required. Chrome’s stable release 138.0.7204...

WordPress Mediabay - WordPress Media Library Folders <= 1.4 - SQL Injection Vulnerability

WordPress Mediabay - WordPress Media Library Folders = 1.4 - SQL Injection Vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin Mediabay - WordPress Media Library Folders versions = 1.4...

WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.4.9 - Subscriber+ SQL Injection vulnerability

Subscriber+ SQL Injection vulnerability discovered by astra.r3verii in WordPress Plugin ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes versions = 1.4.9...

WordPress URL Shortener <= 3.0.7 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by ch4r0n in WordPress Plugin URL Shortener versions = 3.0.7...

setuptools: Path Traversal Vulnerability in setuptools PackageIndex

A path traversal vulnerability in the Python setuptools library allows attackers with limited system access to write files outside the intended temporary directory by manipulating package download URLs. This flaw bypasses basic filename sanitization and can lead to unauthorized overwrites of...

PT-2025-29619 · Oracle · Oracle Weblogic Server

Name of the Vulnerable Software and Affected Versions: Oracle WebLogic Server versions 12.2.1.4.0 Oracle WebLogic Server versions 14.1.1.0.0 Oracle WebLogic Server versions 14.1.2.0.0 Description: A vulnerability exists within the Core component of Oracle WebLogic Server, potentially allowing a...

PT-2025-29668 · Oracle · Virtualbox

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox version 7.1.10 Description: An easily exploitable issue exists in the Oracle VM VirtualBox Core component that allows a high-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox executes ...

PT-2025-29642 · Oracle +1 · Mysql Server

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 9.0.0 through 9.1.0 Description: A vulnerability exists in the Oracle MySQL Server component: Server: Optimizer. This issue allows a high-privileged attacker with network access via multiple protocols to compromise MySQL...

PT-2025-29662

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.0 through 8.0.42 Description A flaw exists in the Oracle MySQL Server Replication component that allows a high-privileged attacker with network access to cause a denial-of-service DoS condition, resulting in a hang or...

WordPress Visual Art | Gallery WordPress Theme Theme <= 2.4 is vulnerable to PHP Object Injection

Software Visual Art | Gallery WordPress Theme Type Theme Vulnerable versions = 2.4 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-31422 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID f75a5b9fac9b Credits Tran Nguyen Bao Khanh VC...

PT-2025-29602 · Oracle · Oracle Database Server

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 19.3 through 19.27 Oracle Database Server versions 21.3 through 21.18 Oracle Database Server versions 23.4 through 23.8 Description: This issue resides within the Unified Audit component of Oracle Database...

PT-2025-29633

Name of the Vulnerable Software and Affected Versions Oracle MySQL versions 8.0.0 through 8.0.42 Oracle MySQL versions 8.4.0 through 8.4.5 Oracle MySQL versions 9.0.0 through 9.3.0 Description A vulnerability exists in the Server: Stored Procedure component of Oracle MySQL Server. Successful...

Tuesday, July 15, 2025 Security Releases

Tuesday, July 15, 2025 Security Releases Security releases available Updates are now available for the 24.x, 22.x, 20.x Node.js release lines for the following issues. Windows Device Names CON, PRN, AUX Bypass Path Traversal Protection in path.normalize CVE-2025-27210 - high An incomplete fix has...

WaFusion: a Wavelet-Enhanced Diffusion Framework for Face Morph Generation

Biometric face morphing poses a critical challenge to identity verification systems, undermining their security and robustness. To address this issue, we propose WaFusion, a novel framework combining wavelet decomposition and diffusion models to generate high-quality, realistic morphed face image...

Multi-Trigger Poisoning Amplifies Backdoor Vulnerabilities in LLMs

Recent studies have shown that Large Language Models LLMs are vulnerable to data poisoning attacks, where malicious training examples embed hidden behaviours triggered by specific input patterns. However, most existing works assume a phrase and focus on the attack's effectiveness, offering limite...

PT-2025-29647

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.42 MySQL Server versions 8.4.5 MySQL Server versions 9.3.0 Description This issue affects the Server: DDL component of Oracle MySQL. A high-privileged attacker with network access can compromise MySQL Server,...

Oracle VirtualBox BusLogic Uninitialized Memory Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within...

Stable Channel Update for Desktop

The Stable channel has been updated to 138.0.7204.157/.158 for Windows, Mac and 138.0.7204.157 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. Security Fixes and Rewards Note: Access to bug details and links may be kept...

SUSE CVE-2025-7519

A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account i...

WordPress HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. plugin <= 2.2.1 - Directory Traversal to Arbitrary File Move vulnerability

Directory Traversal to Arbitrary File Move vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin HT Contact Form 7 versions = 2.2.1...