Mozilla Firefox Security Update (mfsa_2025-42) - Windows

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

CVE-2022-1063

The Thank Me Later WordPress plugin through 3.3.4 does not sanitise and escape the Message Subject field before outputting it in the Messages list, which could allow high privileges users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2025-37853

Mode C: CVE-2025-37853 affects the Linux kernel DRM/AMDKFD debugfs hang_hws interface for MES path, where a NULL pointer dereference (dqm->packet_mgr not set up) can crash the kernel during MES GPU reset testing. The advisory notes the issue is resolved by skipping MES for now and that MES han...

CVE-2025-32022

Finit provides fast init for Linux systems. Finit's urandom plugin has a heap buffer overwrite vulnerability at boot which leads to it overwriting other parts of the heap, possibly causing random instabilities and undefined behavior. The urandom plugin is enabled by default, so this bug affects...

CVE-2025-0632

Local File Inclusion LFI vulnerability in a Render function of Formulatrix Rock Maker Web RMW allows a remote attacker to obtain sensitive data via arbitrary code execution. A malicious actor could execute malicious scripts to automatically download configuration files in known locations to...

UBUNTU-CVE-2022-47112

7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits. Some later versions are unaffected...

CVE-2025-32931

DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command...

PT-2025-16024 · Unknown · Codelit Courselit

Name of the Vulnerable Software and Affected Versions: CodeLit CourseLit versions prior to 0.57.5 Description: The issue allows Parameter Tampering via a payment plan associated with the wrong entity. Recommendations: For versions prior to 0.57.5, update to version 0.57.5 or later to resolve the...

DEBIAN-CVE-2023-53014

In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra: Fix memory leak in terminateall Terminate vdesc when terminating an ongoing transfer. This will ensure that the vdesc is present in the descterminated list The descriptor will be freed later in descfreelist. Thi...

UBUNTU-CVE-2025-30348

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string with relocation of later data...

PT-2025-6601 · WordPress · The Flexible Wishlist For Woocommerce

Name of the Vulnerable Software and Affected Versions: Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress versions up to, and including, 1.2.26 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on...

PT-2025-4635 · Elementor · Traveler Layout Essential For Elementor

Name of the Vulnerable Software and Affected Versions: Traveler Layout Essential For Elementor versions 1.0.8 and earlier Description: The issue is related to a Server-Side Request Forgery SSRF problem. This is a type of security vulnerability where an attacker can trick a server into making...

PT-2025-5417 · Unknown · Landing Page Cat

Name of the Vulnerable Software and Affected Versions: Landing Page Cat versions 1.7.7 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This means an attacker can inject malicious scripts...

PT-2025-5419 · Unknown · Nested Pages

Name of the Vulnerable Software and Affected Versions: Nested Pages versions 3.2.9 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

LibreOffice Multiple Vulnerabilities (Jan 2025) - Mac OS X

LibreOffice is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:libreoffice:libreoffice";...

PT-2025-1450 · Storeapps · Putler Connector For Woocommerce

Name of the Vulnerable Software and Affected Versions: Putler Connector for WooCommerce versions n/a through 2.12.0 Description: A Missing Authorization issue is present in the Putler / Storeapps Putler Connector for WooCommerce. This issue allows for unauthorized access. Recommendations: For...

PT-2025-1371 · Analytify · Analytify

Name of the Vulnerable Software and Affected Versions: Analytify versions n/a through 4.2.3 Description: The issue is related to a Missing Authorization vulnerability in Analytify. This vulnerability allows unauthorized access due to the lack of proper authorization checks. Recommendations: For...

PT-2024-36704 · WordPress · Azzaroco Wp Superbackup

Name of the Vulnerable Software and Affected Versions: Azzaroco WP SuperBackup versions 2.3.3 and earlier Description: The issue is related to a Missing Authorization vulnerability, allowing the exploitation of incorrectly configured access control security levels. This can lead to unauthorized...

PT-2024-41361 · Opensuse +1 · Govulncheck-Vulndb

Name of the Vulnerable Software and Affected Versions: govulncheck-vulndb versions prior to 0.0.20241218T202206 Description: This update addresses multiple Go CVE Numbering Authority IDs, including aliases for various vulnerabilities. Recommendations: govulncheck-vulndb versions prior to...

PT-2024-39458 · Hms Networks · Ewon Flexy 205

Name of the Vulnerable Software and Affected Versions: Ewon Flexy 205 versions through 14.8s0 Description: A code injection vulnerability in HMS Networks Ewon Flexy 205 allows executing commands on system level on the device. Recommendations: For Ewon Flexy 205 versions through 14.8s0, update to ...