Fedora 43 : chromium (2025-3c51a0ed51)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-3c51a0ed51 advisory. Update to 143.0.7499.40 High CVE-2025-13630: Type Confusion in V8 High CVE-2025-13631: Inappropriate implementation in Google Updater High...

WordPress Nouri.sh Newsletter plugin <= 1.0.1.3 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] vulnerability

Reflected Cross-Site Scripting via $SERVER'PHPSELF' vulnerability discovered by Abdulsamad Yusuf 0xVenus - Envorasec in WordPress Plugin Nouri.sh Newsletter versions = 1.0.1.3...

WordPress WP-SOS-Donate Donation Sidebar Plugin plugin <= 0.9.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] vulnerability

Reflected Cross-Site Scripting via $SERVER'PHPSELF' vulnerability discovered by Abdulsamad Yusuf 0xVenus - Envorasec in WordPress Plugin WP-SOS-Donate versions = 0.9.2...

WebXR Flaw Hits 4 Billion Chromium Users, Update Your Browser Now

Cybersecurity startup AISLE discovered a Medium severity flaw in the WebXR component of Chrome, Edge, and other Chromium browsers. Over 4 billion devices were at risk. Update now...

vlc:vlc-demux-dec-libfuzzer-ty: Heap-buffer-overflow in check_sync_pes

Project: https://github.com/videolan/vlc.git Detailed Report: https://oss-fuzz.com/testcase?key=6618299413889024 Project: vlc Fuzzing Engine: honggfuzz Fuzz Target: vlc-demux-dec-libfuzzer-ty Job Type: honggfuzzasanvlc Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...

DEBIAN-CVE-2025-13992

Side-channel information leakage in Navigation and Loading in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

Linux Distros Unpatched Vulnerability : CVE-2025-13721

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security...

Advisory ROSA-SA-2025-3107

Software: libssh 0.9.6 OS: ROSA Virtualization 2.1 packageevrstring: libssh-0.9.6-14.rv3 CVE-ID: CVE-2023-48795 BDU-ID: 2023-08853 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the SSH protocol implementation is related to the ability to adjust packet sequence numbers during the connection...

Advisory ROSA-SA-2025-3111

Software: pixman 0.38.4 OS: ROSA Virtualization 2.1 packageevrstring: pixman-0.38.4-4.rv3 CVE-ID: CVE-2020-35492 BDU-ID: 2021-03445 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the image-compositor.c component of the Cairo vector graphics library is related to a data stack buffer overflow...

Advisory ROSA-SA-2025-3094

Software: curl 7.61.1 OS: ROSA Virtualization 2.1 packageevrstring: curl-7.61.1-34.0.2.rv3.2 CVE-ID: CVE-2022-32221 BDU-ID: 2022-07403 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the cURL command line utility is related to a logical error in the reused descriptor when processing subsequent...

WordPress Studiocart plugin <= 2.9.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin WordPress eCommerce Plugin – Studiocart versions = 2.9.0...

WordPress Backup Migration plugin <= 1.4.9 - Information Exposure to Unauthenticated Back-up Download vulnerability

Information Exposure to Unauthenticated Back-up Download vulnerability discovered by ymmfty0 in WordPress Plugin Backup Migration versions = 1.4.9...

tinyusb:msc: Crash in msc

Detailed Report: https://oss-fuzz.com/testcase?key=6065053163126784 Project: tinyusb Fuzzing Engine: libFuzzer Fuzz Target: msc Job Type: libfuzzerasantinyusb Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000f2010100 Crash State: msc Sanitizer: address ASAN Recommended Security...

bloaty:fuzz_target: Heap-buffer-overflow in bloaty::dwarf::LineInfoReader::GetExpandedFilename

Project: https://github.com/google/bloaty.git Detailed Report: https://oss-fuzz.com/testcase?key=5965791637078016 Project: bloaty Fuzzing Engine: afl Fuzz Target: fuzztarget Job Type: aflasanbloaty Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x77f7e69e6160 Crash Stat...

kimageformats:kimgio_exr_fuzzer: Use-of-uninitialized-value in Imf_3_3::RgbaYca::reconstructChromaHoriz

Detailed Report: https://oss-fuzz.com/testcase?key=6588443514961920 Project: kimageformats Fuzzing Engine: libFuzzer Fuzz Target: kimgioexrfuzzer Job Type: libfuzzermsankimageformats Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

EUVD-2025-199138

Malicious code in @surajh/medium-common npm...

kimageformats:kimgio_raw_fuzzer: Use-of-uninitialized-value in LibRaw::identify

Detailed Report: https://oss-fuzz.com/testcase?key=5143724293423104 Project: kimageformats Fuzzing Engine: libFuzzer Fuzz Target: kimgiorawfuzzer Job Type: libfuzzermsankimageformats Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: LibRaw::identify...

CVE-2025-62297

SOPlanning is vulnerable to Stored XSS in /projets endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening edited page. This issue was fixed in version 1.55...

CVE-2025-62296

SOPlanning is vulnerable to Stored XSS in /taches endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening editor. This issue was fixed in version 1.55...

CVE-2025-62295

SOPlanning is vulnerable to Stored XSS in /groupeform endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening editor. This issue was fixed in version 1.55...