CVE-2025-11835

CVE-2025-11835 affects the WordPress plugin “Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction.” The issue arises from a missing capability check and validation in PMS_AJAX_Checkout_Handler::process_payment(), leading to unauthorized data modificatio...

CVE-2025-43443

A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4:...

CVE-2025-43421

A flaw was found in WebKitGTK. Processing malicious web content can cause multiple issues in the JIT compiler and result in an unexpected process crash. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4...

CVE-2025-43427

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4:...

CVE-2025-43432

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packag...

CVE-2025-43365

A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26 and iPadOS 26. An unprivileged process may be able to terminate a root processes...

CVE-2025-43435

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash...

CVE-2025-43440

A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4:...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990240)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990240 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: Skip task with pid=1 in sendsignalcommon The following kernel panic can be triggered when a...

Amazon Linux 2 : webkitgtk4, --advisory ALAS2-2025-3059 (ALAS-2025-3059)

The version of webkitgtk4 installed on the remote host is prior to 2.48.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3059 advisory. The issue was addressed with improved memory handling. This issue is fixed in Safari 26, visionOS 26, watchOS 26, macO...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990246)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990246 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix signedness bug in sdmav40processtrapirq The instance variable needs to be signed...

Unity Linux 20.1050e Security Update: kernel (UTSA-2025-990101)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990101 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: don't BUG if someone dirty pages without asking ext4 first unpinuserpagesremote is dirtying...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989641)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989641 advisory. In the Linux kernel, the following vulnerability has been resolved: tcp: tcprtxsynack can be called from process context Laurent reported the enclosed report 1 This...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-989759)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989759 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: Skip task with pid=1 in sendsignalcommon The following kernel panic can be triggered when a...

Design and Detection of Covert Man-In-The-Middle Cyberattacks on Water Treatment Plants

Cyberattacks targeting critical infrastructures, such as water treatment facilities, represent significant threats to public health, safety, and the environment. This paper introduces a systematic approach for modeling and assessing covert man-in-the-middle MitM attacks that leverage system...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-989834)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989834 advisory. In the Linux kernel, the following vulnerability has been resolved: w1: fix WARNING after calling w1process I got the following WARNING message while removing...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989431)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989431 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix signedness bug in sdmav40processtrapirq The instance variable needs to be signed...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988839)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988839 advisory. In the Linux kernel, the following vulnerability has been resolved: tcp: tcprtxsynack can be called from process context Laurent reported the enclosed report 1 This...

CVE-2025-27064 Buffer Over-read in Core Services

Information disclosure while registering commands from clients with diag through diagHal...

CVE-2025-43443

This issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash...