CVE-2025-40174

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix SMP ordering in switchmmirqsoff Stephen noted that it is possible to not have an smpmb between the loadedmm store and the tlbgen load in switchmm, meaning the ordering against flushtlbmmrange goes out the window, and ...

CVE-2025-12018 MembershipWorks <= 6.14 - Authenticated (Admin+) Stored Cross-Site Scripting

The MembershipWorks – Membership, Events & Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-11215

Off by one error in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Chromium security severity: Medium...

EUVD-2025-60938

The Squirrels Auto Inventory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2025-12538

CVE-2025-12538 relates to the WordPress plugin Fleet Manager. The vulnerability is a Stored Cross‑Site Scripting (Stored XSS) in admin settings, affecting versions up to and including 2.5.1. Exploitation requires an attacker with at least editor-level permissions and only impacts multisite instal...

CVE-2025-11215

Off by one error in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Chromium security severity: Medium...

AZL-69878 CVE-2025-11215 affecting package nodejs for versions less than 24.14.1-3

Off by one error in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-11215

Off by one error in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-11215

An off-by-one error in the V8 engine allows a remote attacker to perform an out-of-bounds memory read via a crafted HTML page. This vulnerability affects Google Chrome prior to version 141.0.7390.54 , as well as other Chromium-based browsers. To remediate this issue, users should upgrade to the l...

CVE-2025-43496

The issue was addressed by adding additional logic. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Remote content may be loaded even when the 'Load Remote Images' setting is turned off...

CVE-2025-54332

An issue was discovered in NPU in Samsung Mobile Processor Exynos 1380 through July 2025. There is a NULL Pointer Dereference of profiler.node in the npuvertexprofileoff function...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990248)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990248 advisory. In the Linux kernel, the following vulnerability has been resolved: arm64: asm-bug: Add .align 2 to the end of BUGENTRY When CONFIGDEBUGBUGVERBOSE=n, we fail to add...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988759)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988759 advisory. In the Linux kernel, the following vulnerability has been resolved: of: fdt: fix off-by-one error in unflattendtnodes Commit 78c44d910d3e drivers/of: Fix depth when...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988686)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988686 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix off by one in BIOS boundary checking Bounds checking when parsing init scripts...

CVE-2025-43496

The issue was addressed by adding additional logic. This issue is fixed in watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, iOS 18.7.2 and iPadOS 18.7.2, macOS Sequoia 15.7.2, visionOS 26.1. Remote content may be loaded even when the 'Load Remote Images' setting is turned off...

CVE-2025-43496

The issue was addressed by adding additional logic. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Remote content may be loaded even when the 'Load Remote Images' setting is turned off...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: can: netlink: canchangelink: fix NULL pointer deref of struct canpriv::dosetmode Andrei Lalaev reported a NULL pointer deref when a CAN device is restarted from Bus Off and the driver does not implement the struct...

Astra Linux – vulnerability in Imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 contain a heap buffer overflow in the InterpretImageFilename function. The problem arises from an off-by-one error that leads to out-of-bounds memory access when...

Astra Linux – vulnerability in gnutls28

A heap buffer overflow off-by-one flaw was found in the GnuTLS software within the template parsing logic of the certtool utility. When reading certain settings from a template file, it allows an attacker to perform an out-of-bounds OOB NULL pointer write, leading to memory corruption and a...

CVE-2025-63462

Totolink A7000R v9.1.0u.6115B20201022 was discovered to contain a stack overflow via the wifiOff parameter in the sub421A04 function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...