CVE-2025-46734

league/commonmark is a PHP Markdown parser. A cross-site scripting XSS vulnerability in the Attributes extension of the league/commonmark library versions 1.5.0 through 2.6.x allows remote attackers to insert malicious JavaScript calls into HTML. The league/commonmark library provides configurati...

AMD SMM Vulnerabilities February 2025 Security Update

AMD has informed HP of potential vulnerabilities identified in some AMD client platform firmware components, which might allow arbitrary code execution. AMD is releasing firmware updates to mitigate these vulnerabilities. AMD has released updates to mitigate the potential vulnerabilities. HP has...

MAL-2025-3627 Malicious code in istanbul-reporter-lcov (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f78f358d122dd8a0f065ddfff80c9983f2fefa9f82579dacbeb8b3e10a9c60d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Milesight UG65-868M-EA

RISK EVALUATION Successful exploitation of this vulnerability could allow any user with admin privileges to inject arbitrary shell commands. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Ensure that...

PT-2025-19726 · Erpnext · Erpnext

Name of the Vulnerable Software and Affected Versions: ERPNEXT versions 14.74.3 through 14.82.1 Description: A Cross-Site Request Forgery CSRF vulnerability was discovered, allowing an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to...

MAL-2025-3598 Malicious code in font-impact (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 404db1db5b86b6ce6ed40f2169b12625d010c431f4610548c55dc053f5d43d69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-53087

In the Linux kernel, the following vulnerability has been resolved: drm/i915/active: Fix misuse of non-idle barriers as fence trackers Users reported oopses on list corruptions when using i915 perf with a number of concurrently running graphics applications. Root cause analysis pointed at an issu...

Bolster Your Regulatory Compliance with Layered Security Measures

...

CVE-2022-49829

In the Linux kernel, the following vulnerability has been resolved: drm/scheduler: fix fence ref counting We leaked dependency fences when processes were beeing killed. Additional to that grab a reference to the last scheduled fence...

CVE-2022-49837

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix memory leaks in checkfunccall kmemleak reports this issue: unreferenced object 0xffff88817139d000 size 2048: comm "testprogs", pid 33246, jiffies 4307381979 age 45851.820s hex dump first 32 bytes: 01 00 00 00 00 00 00 00...

Commvault Confirms Hackers Exploited CVE-2025-3928 as Zero-Day in Azure Breach

Enterprise data backup platform Commvault has revealed that an unknown nation-state threat actor breached its Microsoft Azure environment by exploiting CVE-2025-3928 but emphasized there is no evidence of unauthorized data access. "This activity has affected a small number of customers we have in...

ASB-A-394100273

Bulletin has no description...

ABB Automation Builder (Update A)

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to overrule the Automation Builder's user management. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize...

Exploit for CVE-2025-1974

CVE-2025-1974 화이트햇 스쿨 3기 - 김소은 @salt318 https://github...

PT-2025-22309 · Linksys · Linksys Fgw3000-Hk +1

Name of the Vulnerable Software and Affected Versions: Linksys FGW3000-AH and FGW3000-HK versions up to 1.0.17.000000 Description: A critical issue was found, affecting the function sub 4153FC of the file /cgi-bin/sysconf.cgi in the HTTP POST Request Handler component. The manipulation of the...

PT-2025-17935 · Mytel Telecom · Mytel Telecom Online Account System

Name of the Vulnerable Software and Affected Versions: Mytel Telecom Online Account System version 1.0 Description: An issue in the system allows attackers to bypass the OTP verification process via a crafted request. Recommendations: For Mytel Telecom Online Account System version 1.0, consider...

CVE-2025-21605

A flaw was found in the Redis server. This flaw allows an unauthenticated client to cause an unlimited growth of output buffers until the server runs out of memory or is killed. By default, the Redis configuration does not limit the output buffer of normal clients see client-output-buffer-limit...

Regulating AI Behavior with a Hypervisor

Interesting research: "Guillotine: Hypervisors for Isolating Malicious AIs." Abstract :As AI models become more embedded in critical sectors like finance, healthcare, and the military, their inscrutable behavior poses ever-greater risks to society. To mitigate this risk, we propose Guillotine, a...

PT-2025-17563 · Unknown · Student Study Center Desk Management System

Name of the Vulnerable Software and Affected Versions: Student Study Center Desk Management System version 1.0 Description: The issue allows attackers to bypass authentication via a crafted GET request to "/php-sscdms/admin/login.php". This enables unauthorized access to the system...

code-projects Online Exam Mastering System 1.0 - Reflected Cross-Site Scripting (XSS)

Exploit Title: code-projects Online Exam Mastering System 1.0 - Reflected Cross-Site Scripting XSS Google Dork: inurl:/exam/feedback.php Date: 2025-04-19 Exploit Author: Pruthu Raut Vendor Homepage: https://code-projects.org/ Software Link:...