Alibaba Cloud Linux 3 : 0162: webkit2gtk3 (ALINUX3-SA-2022:0162)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0162 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2021-1844: A memory corruption issue w...

webkitgtk: Processing web content may lead to a denial-of-service

A flaw was found in WebKitGTK. Processing malicious web content can cause a denial of service due to improper memory handling...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash

A flaw was found in WebKitGTK. Processing malicious web content can cause a buffer overflow due to improper memory handling and result in an unexpected process crash...

CVE-2025-31238

The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption...

Apple多款产品 安全漏洞

Apple macOS and others are products of Apple Inc.Apple macOS is a dedicated operating system developed for Mac computers.Apple iPadOS is an operating system for iPad tablets.Apple visionOS is an operating system for AR glasses. A security vulnerability exists in several Apple products, which stem...

Spam campaign targeting Brazil abuses Remote Monitoring and Management tools

Cisco Talos identified a spam campaign targeting Brazilian users with commercial remote monitoring and management RMM tools since at least January 2025. Talos observed the use of PDQ Connect and N-able remote access tools in this campaign. The spam message uses the Brazilian electronic invoice...

Cross-Site Scripting (XSS)

yeswiki/yeswiki is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient input sanitization of the idformulaire parameter on the /?BazaR endpoint, which allows attackers to perform reflected cross-site scripting attacks to steal session cookies, hijack user sessions,...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper checks...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash

A flaw was found in WebKitGTK. Processing malicious web content can cause a buffer overflow due to improper memory handling and result in an unexpected process crash...

CVE-2025-46549 Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, an attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability...

CVE-2025-46549 Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, an attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability...

CVE-2025-46549

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, an attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability...

CVE-2025-46549

YesWiki is a PHP-based wiki. The CVE-2025-46549/YesWiki vulnerability is a reflected cross-site scripting flaw present in YesWiki versions prior to 4.5.4, caused by insufficient sanitization of user input in the template parameter (endpoint: /?BazaR/bazariframe). An attacker can lure an authentic...

CVE-2025-46350

YesWiki (PHP) before v4.5.4 is vulnerable to a reflected XSS via the incomingurl parameter on the vulnerable endpoint (e.g., /?PagePrincipale/deletepage). The vulnerability allows an attacker to steal cookies from an authenticated user and potentially hijack the session, and could enable defaceme...

New Reports Uncover Jailbreaks, Unsafe Code, and Data Theft Risks in Leading AI Systems

Various generative artificial intelligence GenAI services have been found vulnerable to two types of jailbreak attacks that make it possible to produce illicit or dangerous content. The first of the two techniques, codenamed Inception, instructs an AI tool to imagine a fictitious scenario, which...

HTML Injection

verbb/formie is vulnerable to HTML injection. The vulnerability is due to insufficient sanitization of HTML content in the email notification preview feature, allows an attacker to inject malicious HTML content into the email notification preview...

webkitgtk: Processing web content may lead to a denial-of-service

A flaw was found in WebKitGTK. Processing malicious web content can cause a denial of service due to improper memory handling...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash

A flaw was found in WebKitGTK. Processing malicious web content can cause a buffer overflow due to improper memory handling and result in an unexpected process crash...

Kentico Xperience cross-site scripting vulnerability (CNVD-2026-05132)

Kentico Xperience is a digital experience platform from Kentico. Kentico Xperience suffers from a cross-site scripting vulnerability that can be exploited by an attacker to allow an authenticated user to distribute malicious content via specific interactions with the media library file upload...

CVE-2025-32427

Formie is a Craft CMS plugin for creating forms. Prior to 2.1.44, when importing a form from JSON, if the field label or handle contained malicious content, the output wasn't correctly escaped when viewing a preview of what was to be imported. As imports are undertaking primarily by users who hav...