Use after free in Dawn in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) CVSSv3.1 8.8 (HIGH) · EPSS 19th percentile
Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set. CVSSv3.1 8.2 (HIGH) · EPSS 19th percentile
Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length. CVSSv3.1 8.2 (HIGH) · EPSS 18th percentile
Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet. CVSSv3.1 8.2 (HIGH) · EPSS 18th percentile
A flaw has been found in Magnetism Studios Endurance up to 3.3.0 on macOS. This affects the function loadModuleNamed:WithReply of the file /Applications/Endurance.app/Contents/Library/LaunchServices/com.MagnetismStudios.endurance.helper of the component NSXPC Interface. Executing manipulation can lead to missing authentication. The attack needs to be launched locally. The exploit has been published and may be used. CVSSv3.1 8.4 (HIGH) · EPSS 8th percentile
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Check encryption key size on incoming connection This is required for passing GAP/SEC/SEM/BI-04-C PTS test case: Security Mode 4 Level 4, Responder - Invalid Encryption Key Size - 128 bit This tests the security key with size from 1 to 15 bytes while the Security Mode 4 Level 4 requests 16 bytes key size. Currently PTS fails with the following logs: - expected:Connection Response: CVSSv3.1 8.1 (HIGH) · EPSS 1th percentile
The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially compromise it. CVSSv3.1 9.8 (CRITICAL) · EPSS 41th percentile
Trend Micro research details three primary attack vectors for compromising Large Language Models: embedding malicious code in serialized model files (particularly pickle format), injecting backdoors via poisoned training data with hidden triggers, and deploying malicious LoRA adapters that modify model behavior without altering the base model. The analysis emphasizes that AI supply chain attacks exploit the collaborative ecosystem of model sharing platforms, with payloads remaining dormant until activated by specific triggers or conditions.
A supply-chain attack on Salesloft-Drift's AI chatbot platform compromised OAuth tokens and exposed data from 700+ organizations, including major security vendors (Palo Alto Networks, Cloudflare, Zscaler). Threat actor UNC6395 stole credentials from a GitHub repository, pivoted through Drift's cloud integrations, and systematically exfiltrated customer data from connected Salesforce instances over a 10-day window in August 2025. Okta was targeted but protected by IP allow-listing on their OAuth tokens, demonstrating the critical importance of defense-in-depth controls for AI integrations.
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, the Prompt module allows execution of commands that can return raw HTML. Malicious input, even if sanitized for display elsewhere, can be executed when processed through certain commands, leading to potential script execution (XSS). This issue has been patched in version 10.1.0. CVSSv3.1 9.0 (CRITICAL) · EPSS 40th percentile
Untrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Libraries) allows Pointer Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.6.0, from 7.0.0 before 7.3.0.10, from 6.1.0 before 6.1.2.27, from 6.0.0 before 6.0.1.43, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, from 4.4a before 5.1.*. CVSSv3.1 9.1 (CRITICAL) · EPSS 31th percentile
Untrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Libraries) allows Pointer Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.6.0, from 7.2.0 before 7.3.0.9. CVSSv3.1 9.1 (CRITICAL) · EPSS 31th percentile
A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with th CVSSv3.1 8.8 (HIGH) · EPSS 50th percentile
Uncontrolled Search Path Element vulnerability in Salesforce Salesforce CLI on Windows allows Replace Trusted Executable.This issue affects Salesforce CLI: before 2.106.6. CVSSv3.1 8.8 (HIGH) · EPSS 38th percentile
Unrestricted Upload of File with Dangerous Type vulnerability in TalentSys Consulting Information Technology Industry Inc. Inka.Net allows Command Injection. This issue affects Inka.Net: before 6.7.1. CVSSv3.1 10.0 (CRITICAL) · EPSS 51th percentile
A maliciously crafted HTML payload, when rendered by the Autodesk Fusion desktop application, can trigger a Stored Cross-site Scripting (XSS) vulnerability. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process. CVSSv3.1 8.7 (HIGH) · EPSS 37th percentile
The Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin for WordPress is vulnerable to arbitrary file uploads due to misconfigured file type validation in the 'uni_cpo_upload_file' function in all versions up to, and including, 4.9.55. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSSv3.1 9.8 (CRITICAL)
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netcad Software Inc. Netigma allows Stored XSS. This issue affects Netigma: from 6.3.3 before 6.3.5 V8. CVSSv3.1 8.9 (HIGH) · EPSS 13th percentile
The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_as_original_file' function in all versions up to, and including, 4.2.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSSv3.1 9.8 (CRITICAL) · EPSS 60th percentile
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows Command Injection. This issue affects enVision: before 250563. CVSSv3.1 10.0 (CRITICAL) · EPSS 60th percentile
In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: fix potential OF node use-after-free The for_each_child_of_node() helper drops the reference it takes to each node as it iterates over children and an explicit of_node_put() is only needed when exiting the loop early. Drop the recently introduced bogus additional reference count decrement at each iteration that could potentially lead to a use-after-free. CVSSv3.1 8.4 (HIGH) · EPSS 4th percentile
In the Linux kernel, the following vulnerability has been resolved: libceph: fix invalid accesses to ceph_connection_v1_info There is a place where generic code in messenger.c is reading and another place where it is writing to con->v1 union member without checking that the union member is active (i.e. msgr1 is in use). On 64-bit systems, con->v1.auth_retry overlaps with con->v2.out_iter, so such a read is almost guaranteed to return a bogus value instead of 0 when msgr2 i CVSSv3.1 9.8 (CRITICAL) · EPSS 4th percentile
In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map Fix a critical memory allocation bug in edma_setup_from_hw() where queue_priority_map was allocated with insufficient memory. The code declared queue_priority_map as s8 (*)[2] (pointer to array of 2 s8), but allocated memory using sizeof(s8) instead of the correct size. This caused out-of-bounds memory writes when accessing: queue_pri CVSSv3.1 8.4 (HIGH) · EPSS 4th percentile
The WPCasa plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.4.1. This is due to insufficient input validation and restriction on the 'api_requests' function. This makes it possible for unauthenticated attackers to call arbitrary functions and execute code. CVSSv3.1 9.8 (CRITICAL) · EPSS 56th percentile
SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986. CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile