In the Linux kernel, the following vulnerability has been resolved: sctp: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this. CVSSv3.1 8.1 (HIGH) · EPSS 9th percentile
In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk and calls inet_child_forget(), which calls tcp_disconnect() for the TFO socket. After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove( CVSSv3.1 8.1 (HIGH) · EPSS 11th percentile
A SQL injection vulnerability exists in the login functionality of WellSky Harmony version 4.1.0.2.83 within the 'xmHarmony.asp' endpoint. User-supplied input to the 'TXTUSERID' parameter is not properly sanitized before being incorporated into a SQL query. Successful authentication may lead to authentication bypass, data leakage, or full system compromise of backend database contents. CVSSv3.1 9.8 (CRITICAL) · EPSS 36th percentile
If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, since an attacker could send a request for a realm matching a DNS zone where they created SRV records pointing to arbitrary ports and hostnames (which may resolve to loopback or internal IP addresses). This vulnerability ca CVSSv3.1 8.6 (HIGH) · EPSS 32th percentile
A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-Scoped* Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a namespace, to create a MonitorStack in the authorized namespace and then elevate permission to the cluster level by impersonating the ServiceAccount created by the Operator, resulti CVSSv3.1 8.8 (HIGH) · EPSS 24th percentile
Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) CVSSv3.1 8.8 (HIGH) · EPSS 18th percentile
watchTowr Labs disclosed two vulnerabilities in Citrix NetScaler: WT-2025-0089, a memory leak triggered by misconfiguring an AAA virtual server without enabling the AAA feature (no CVE assigned due to low real-world likelihood), and WT-2025-0090, a reflected XSS in the SAML RelayState parameter (CVE-2025-12101). The XSS is exploitable via CSRF when a valid SAMLResponse is paired with a crafted RelayState parameter containing injected HTML/JavaScript.
In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending async decryptions if tls_strp_msg_hold fails Async decryption calls tls_strp_msg_hold to create a clone of the input skb to hold references to the memory it uses. If we fail to allocate that clone, proceeding with async decryption can lead to various issues (UAF on the skb, writing into userspace memory after the recv() call has returned). In this case, wait for all pending decryption CVSSv3.1 9.8 (CRITICAL) · EPSS 8th percentile
In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). smc_clc_prfx_match() is called from smc_listen_work() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dst_dev_rcu(). Note that the returned value of smc_clc_prfx_match() is not used in the caller. CVSSv3.1 8.1 (HIGH) · EPSS 7th percentile
In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_output() Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent possible UAF. We can remove rcu_read_lock()/rcu_read_unlock() pairs from ip6_finish_output2(). CVSSv3.1 8.1 (HIGH) · EPSS 11th percentile
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix possible UAF on iso_conn_free This attempt to fix similar issue to sco_conn_free where if the conn->sk is not set to NULL may lead to UAF on iso_conn_free. CVSSv3.1 8.0 (HIGH) · EPSS 10th percentile
In the Linux kernel, the following vulnerability has been resolved: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. This is the sequence of events that leads to the warning: rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); } rtl8150_set_multicast() { netif_stop_queue(); netif_wake_queue(); <-- wakes up TX queue before URB is done } rtl8150_start_xmit() { netif CVSSv3.1 8.8 (HIGH) · EPSS 11th percentile
In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_xmit() Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent possible UAF. CVSSv3.1 8.1 (HIGH) · EPSS 10th percentile
In the Linux kernel, the following vulnerability has been resolved: mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). mptcp_active_enable() is called from subflow_finish_connect(), which is icsk->icsk_af_ops->sk_rx_dst_set() and it's not always under RCU. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dst_dev_rcu(). CVSSv3.1 8.1 (HIGH) · EPSS 9th percentile
A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to run arbitrary commands via the user interface. This user interface can be used via the network and allows the execution of commands as administrative application user. CVSSv3.1 8.8 (HIGH) · EPSS 33th percentile
November 2025 patch Tuesday from Microsoft (63 CVEs, 4 Critical) and Adobe (29 CVEs across 8 products). Microsoft's CVE-2025-62215 is under active exploitation as a Windows kernel race-condition EoP; CVE-2025-60724 (GDI+ RCE, CVSS 9.8) allows unauthenticated network code execution via malformed metafiles; CVE-2025-62222 introduces the first documented Agentic AI RCE in Visual Studio Code. Azure Monitor Agent (CVE-2025-59504) permits unauthenticated RCE without user interaction.
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. CVSSv3.1 9.8 (CRITICAL) · EPSS 37th percentile
Missing authorization in Nuance PowerScribe allows an unauthorized attacker to disclose information over a network. CVSSv3.1 8.1 (HIGH) · EPSS 51th percentile
System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace processes. CVSSv3.1 8.1 (HIGH) · EPSS 1th percentile
Memory safety bugs present in Firefox 144 and Thunderbird 144. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 145 and Thunderbird 145. CVSSv3.1 8.1 (HIGH)
Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145. CVSSv3.1 9.8 (CRITICAL)
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 145 and Thunderbird 145. CVSSv3.1 9.8 (CRITICAL)
Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145. CVSSv3.1 9.8 (CRITICAL)
Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145. CVSSv3.1 9.8 (CRITICAL)
Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145. CVSSv3.1 9.8 (CRITICAL)