deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-53296
Published: 2025-09-16
Description: In the Linux kernel, the following vulnerability has been resolved:

sctp: check send stream number after wait_for_sndbuf

This patch fixes a corner case where the asoc out stream count may change
after wait_for_sndbuf.

When the main thread in the client starts a connection, if its out stream
count is set to N while the in stream count in the server is set to N - 2,
another thread in the client keeps sending the msgs with stream number
N - 1, and waits for sndbuf before processing INIT_ACK.

However, after processing INIT_ACK, the out stream count in the client is
shrunk to N - 2, the same to the in stream count in the server. The crash
occurs when the thread waiting for sndbuf is awake and sends the msg in a
non-existing stream(N - 1), the call trace is as below:

  KASAN: null-ptr-deref in range [0x[PII_REDACTED]000038-0x[PII_REDACTED]00003f]
  Call Trace:
   <TASK>
   sctp_cmd_send_msg net/sctp/sm_sideeffect.c:1114 [inline]
   sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1777 [inline]
   sctp_side_effects net/sctp/sm_sideeffect.c:1199 [inline]
   sctp_do_sm+0x197d/0x5310 net/sctp/sm_sideeffect.c:1170
   sctp_primitive_SEND+0x9f/0xc0 net/sctp/primitive.c:163
   sctp_sendmsg_to_asoc+0x10eb/0x1a30 net/sctp/socket.c:1868
   sctp_sendmsg+0x8d4/0x1d90 net/sctp/socket.c:2026
   inet_sendmsg+0x9d/0xe0 net/ipv4/af_inet.c:825
   sock_sendmsg_nosec net/socket.c:722 [inline]
   sock_sendmsg+0xde/0x190 net/socket.c:745

The fix is to add an unlikely check for the send stream number after the
thread wakes up from the wait_for_sndbuf.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/0443fff49d6352160c200064156c25898bd9f58c; https://git.kernel.org/stable/c/2584024b23552c00d95b50255e47bd18d306d31a; https://git.kernel.org/stable/c/667eb99cf7c15fe5b0ecefe75cf658e20ef20c9f
CVE: CVE-2023-53297
Published: 2025-09-16
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp

conn->chan_lock isn't acquired before l2cap_get_chan_by_scid,
if l2cap_get_chan_by_scid returns NULL, then 'bad unlock balance'
is triggered.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/116b9c002c894097adc2b8684db2d1da4229ed46; https://git.kernel.org/stable/c/2112c4c47d36bc5aba3ddeb9afedce6ae6a67e7d; https://git.kernel.org/stable/c/25e97f7b1866e6b8503be349eeea44bb52d661ce
CVE: CVE-2023-53298
Published: 2025-09-16
Description: In the Linux kernel, the following vulnerability has been resolved:

nfc: fix memory leak of se_io context in nfc_genl_se_io

The callback context for sending/receiving APDUs to/from the selected
secure element is allocated inside nfc_genl_se_io and supposed to be
eventually freed in se_io_cb callback function. However, there are several
error paths where the bwi_timer is not charged to call se_io_cb later, and
the cb_context is leaked.

The patch proposes to free the cb_context explicitly on those error paths.

At the moment we can't simply check 'dev->ops->se_io()' return value as it
may be negative in both cases: when the timer was charged and was not.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/25ff6f8a5a3b8dc48e8abda6f013e8cc4b14ffea; https://git.kernel.org/stable/c/271eed[PII_REDACTED]35c5aac50f15b0f4d236bc0; https://git.kernel.org/stable/c/5321da6d84b87a34eea441677d649c34bd854169
CVE: CVE-2023-53299
Published: 2025-09-16
Description: In the Linux kernel, the following vulnerability has been resolved:

md/raid10: fix leak of 'r10bio->remaining' for recovery

raid10_sync_request() will add 'r10bio->remaining' for both rdev and
replacement rdev. However, if the read io fails, recovery_request_write()
returns without issuing the write io, in this case, end_sync_request()
is only called once and 'remaining' is leaked, cause an io hang.

Fix the problem by decreasing 'remaining' according to if 'bio' and
'repl_bio' is valid.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/11141630f03efffdfe260b3582b2d93d38171b97; https://git.kernel.org/stable/c/1697fb124c6d6c5237e9cbd[PII_REDACTED]4738084; https://git.kernel.org/stable/c/1d2c6c6e37fe5de11fd01a82badf03390e12df7a
CVE: CVE-2023-53300
Published: 2025-09-16
Description: In the Linux kernel, the following vulnerability has been resolved:

media: hi846: Fix memleak in hi846_init_controls()

hi846_init_controls doesn't clean the allocated ctrl_hdlr
in case there is a failure, which causes memleak. Add
v4l2_ctrl_handler_free to free the resource properly.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/07f0f15e5db60c5b0722049d3251ef4a46dc3b76; https://git.kernel.org/stable/c/12a80b1490e398f5ad7157508cf32b73511de5fc; https://git.kernel.org/stable/c/2649c1a20e8e399ee955d0e22192f9992662c3d2
CVE: CVE-2023-53301
Published: 2025-09-16
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix kernel crash due to null io->bio

We should return when io->bio is null before doing anything. Otherwise, panic.

BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
RIP: 0010:__submit_merged_write_cond+0x164/0x240 [f2fs]
Call Trace:
 <TASK>
 f2fs_submit_merged_write+0x1d/0x30 [f2fs]
 commit_checkpoint+0x110/0x1e0 [f2fs]
 f2fs_write_checkpoint+0x9f7/0xf00 [f2fs]
 ? __pfx_issue_checkpoint_thread+0x10/0x10 [f2fs]
 __checkpoint_and_complete_reqs+0x84/0x190 [f2fs]
 ? preempt_count_add+0x82/0xc0
 ? __pfx_issue_checkpoint_thread+0x10/0x10 [f2fs]
 issue_checkpoint_thread+0x4c/0xf0 [f2fs]
 ? __pfx_autoremove_wake_function+0x10/0x10
 kthread+0xff/0x130
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x2c/0x50
 </TASK>
CVSS Score: 7.1 (HIGH)
References: https://git.kernel.org/stable/c/267c159f9c7bcb7009dae16889b880c5ed8759a8; https://git.kernel.org/stable/c/83dbb9a1bd5ef2eea73275906fc50b2fdda39cd5; https://git.kernel.org/stable/c/eb52f13c6093ac761dbeaa459c810fc0253209fc
CVE: CVE-2023-53302
Published: 2025-09-16
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: iwl4965: Add missing check for create_singlethread_workqueue()

Add the check for the return value of the create_singlethread_workqueue()
in order to avoid NULL pointer dereference.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/26e6775f75517ad6844fe5b79bc5f3fa8c22ee61; https://git.kernel.org/stable/c/2f85c768bea2057e3299d19514da9e932c4f92d2; https://git.kernel.org/stable/c/3185d6cfc59277a77bf311dce701b7e25193f66a
CVE: CVE-2023-53303
Published: 2025-09-16
Description: In the Linux kernel, the following vulnerability has been resolved:

net: microchip: vcap api: Fix possible memory leak for vcap_dup_rule()

Inject fault When select CONFIG_VCAP_KUNIT_TEST, the below memory leak
occurs. If kzalloc() for duprule succeeds, but the following
kmemdup() fails, the duprule, ckf and caf memory will be leaked. So kfree
them in the error path.

unreferenced object 0xffff122744c50600 (size 192):
  comm "kunit_try_catch", pid 346, jiffies[PII_REDACTED] (age 911.812s)
  hex dump (first 32 bytes):
    10 27 00 00 04 00 00 00 1e 00 00 00 2c 01 00 00  .'..........,...
    00 00 00 00 00 00 00 00 18 06 c5 44 27 12 ff ff  ...........D'...
  backtrace:
    [<[PII_REDACTED]4b0db8>] __kmem_cache_alloc_node+0x274/0x2f8
    [<[PII_REDACTED]bedc67>] kmalloc_trace+0x38/0x88
    [<00000000b0612f98>] vcap_dup_rule+0x50/0x460
    [<000000005d2d3aca>] vcap_add_rule+0x8cc/0x1038
    [<00000000eef9d0f8>] test_vcap_xn_rule_creator.constprop.0.isra.0+0x238/0x494
    [<00000000cbda607b>] vcap_api_rule_remove_in_front_test+0x1ac/0x698
    [<00000000c8766299>] kunit_try_run_case+0xe0/0x20c
    [<00000000c4fe9186>] kunit_generic_run_threadfn_adapter+0x50/0x94
    [<00000000f6864acf>] kthread+0x2e8/0x374
    [<[PII_REDACTED]e639b3>] ret_from_fork+0x10/0x20
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/281f65d29d6da1a9b6907fb0b145aaf34f4e4822; https://git.kernel.org/stable/c/a26ba60413b2c8f95daf0ee0152cf82abd7bfbe4
CVE: CVE-2024-12367
Published: 2025-09-16
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vegagrup Software Vega Master allows Directory Indexing.This issue affects Vega Master: from v.1.12.35 through 20250916. 

NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.
CVSS Score: 8.6 (HIGH)
CWE: CWE-497
References: https://www.usom.gov.tr/bildirim/tr-25-0249
CVE: CVE-2025-5518
Published: 2025-09-16
Description: Authorization Bypass Through User-Controlled Key vulnerability with user privileges in ArgusTech BILGER allows Exploitation of Trusted Identifiers.This issue affects BILGER: before 2.4.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://www.usom.gov.tr/bildirim/tr-25-0250
CVE: CVE-2025-5519
Published: 2025-09-16
Description: Insertion of Sensitive Information Into Sent Data vulnerability in ArgusTech BILGER allows Choosing Message Identifier.This issue affects BILGER: before 2.4.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://www.usom.gov.tr/bildirim/tr-25-0250
CVE: CVE-2025-10316
Published: 2025-09-16
Description: The extension "Form to Database" is susceptible to Cross-Site Scripting. This issue affects the following versions: before 2.2.5, from 3.0.0 before 3.2.2, from 4.0.0 before 4.2.3, from 5.0.0 before 5.0.2.
CWE: CWE-79
References: https://typo3.org/security/advisory/typo3-ext-sa-2025-012
CVE: CVE-2025-2404
Published: 2025-09-16
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ubit Information Technologies STOYS allows Cross-Site Scripting (XSS).This issue affects STOYS: from 2 before 20250916.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0251
CVE: CVE-2025-4688
Published: 2025-09-16
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BGS Interactive SINAV.LINK Exam Result Module allows SQL Injection.This issue affects SINAV.LINK Exam Result Module: before 1.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-25-0252
CVE: CVE-2025-10015
Published: 2025-09-16
Description: The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with. A local unprivileged attacker can register this XPC service globally which will inherit TCC permissions of the application. 
Lack of validation of connecting client allows the attacker to copy TCC-protected files to an arbitrary location. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission.

This issue was fixed in version 2.7.2
CWE: CWE-863
References: https://cert.pl/en/posts/2025/09/CVE-2025-10015; https://github.com/sparkle-project/Sparkle; https://github.com/sparkle-project/Sparkle/discussions/2764
CVE: CVE-2025-10016
Published: 2025-09-16
Description: The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker  can request installation of crafted malicious PKG file by racing to connect to the daemon when other app spawns it as root. This results in local privilege escalation to root privileges. It is worth noting that it is possible to spawn Autopudate manually via Installer XPC service. However this requires the victim to enter credentials upon system authorization dialog creation that can be modified by the attacker.

This issue was fixed in version 2.7.2
CWE: CWE-863
References: https://cert.pl/en/posts/2025/09/CVE-2025-10015; https://github.com/sparkle-project/Sparkle; https://github.com/sparkle-project/Sparkle/discussions/2764
CVE: CVE-2025-26710
Published: 2025-09-16
Description: There is an an information disclosure vulnerability in ZTE T5400. Due to improper configuration of the access control mechanism, attackers can obtain information through interfaces without authorization, causing the risk of information disclosure.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/[PII_REDACTED]41435667
CVE: CVE-2025-26711
Published: 2025-09-16
Description: There is an unauthorized access vulnerability in ZTE T5400. Due to improper permission control of the Web module interface, an unauthorized attacker can obtain sensitive information through the interface.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200
References: https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/[PII_REDACTED]41435677
CVE: CVE-2025-41248
Published: 2025-09-16
Description: The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue when using @PreAuthorize and other method security annotations, resulting in an authorization bypass.

Your application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature.

You are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces.

This CVE is published in conjunction with  CVE-2025-41249 https://spring.io/security/cve-2025-41249 .
CVSS Score: 7.5 (HIGH)
CWE: CWE-289
References: https://spring.io/security/cve-2025-41248
CVE: CVE-2025-41249
Published: 2025-09-16
Description: The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions.

Your application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature.

You are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces.

This CVE is published in conjunction with  CVE-2025-41248 https://spring.io/security/cve-2025-41248 .
CVSS Score: 7.5 (HIGH)
CWE: CWE-285
References: https://spring.io/security/cve-2025-41249
CVE: CVE-2024-12913
Published: 2025-09-16
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Megatek Communication System Azora Wireless Network Management allows SQL Injection.This issue affects Azora Wireless Network Management: through 20250916. 

NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-25-0253
CVE: CVE-2025-56697
Published: 2025-09-16
Description: A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the /users/adminpanel/admin/home.php?page=feedbacks file of Kashipara Computer Base Test v1.0. Attackers can inject malicious scripts via the smyFeedbacks POST parameter in /users/home.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/scriptjacker/CVE/tree/main/Kashipara/Computer-Base-Test
CVE: CVE-2025-56706
Published: 2025-09-16
Description: Edimax BR-6473AX v1.0.28 was discovered to contain a remote code execution (RCE) vulnerability via the Object parameter in the openwrt_getConfig function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-77
References: https://github.com/woaiqjj/CVE/blob/main/BR-6473AX/1.md
CVE: CVE-2025-6575
Published: 2025-09-16
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dolusoft Omaspot allows Reflected XSS.This issue affects Omaspot: before 12.09.2025.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0254
CVE: CVE-2025-7743
Published: 2025-09-16
Description: Cleartext Transmission of Sensitive Information vulnerability in Dolusoft Omaspot allows Interception, Privilege Escalation.This issue affects Omaspot: before 12.09.2025.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-319
References: https://www.usom.gov.tr/bildirim/tr-25-0254
CVE: CVE-2025-7744
Published: 2025-09-16
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dolusoft Omaspot allows SQL Injection.This issue affects Omaspot: before 12.09.2025.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-25-0254
CVE: CVE-2025-8446
Published: 2025-09-16
Description: The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized limited plugin install due to a missing capability check on the 'blaze_demo_importer_install_plugin' function in all versions up to, and including, 1.0.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate a limited number of specific plugins. The News Kit Elementor Addons plugin and a BlazeThemes theme must be installed and activated in order to exploit the vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/blaze-demo-importer/trunk/blaze-demo-importer.php#L91; https://plugins.trac.wordpress.org/changeset/3361179/; https://www.wordfence.com/threat-intel/vulnerabilities/id/a91bd1cf-ac63-4d65-b9fc-3fa2507cc27e?source=cve
CVE: CVE-2025-10290
Published: 2025-09-16
Description: Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers to spoof websites if users were coerced into opening a link explicitly through a long-press. This vulnerability was fixed in Focus for iOS 143.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-451
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1975566; https://www.mozilla.org/security/advisories/mfsa2025-76/
CVE: CVE-2025-10527
Published: 2025-09-16
Description: Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1984825; https://www.mozilla.org/security/advisories/mfsa2025-73/; https://www.mozilla.org/security/advisories/mfsa2025-75/
CVE: CVE-2025-10528
Published: 2025-09-16
Description: Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
CVSS Score: 7.3 (HIGH)
CWE: CWE-693
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1986185; https://www.mozilla.org/security/advisories/mfsa2025-73/; https://www.mozilla.org/security/advisories/mfsa2025-75/
CVE: CVE-2025-10529
Published: 2025-09-16
Description: Same-origin policy bypass in the Layout component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-942
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1970490; https://www.mozilla.org/security/advisories/mfsa2025-73/; https://www.mozilla.org/security/advisories/mfsa2025-75/
CVE: CVE-2025-10530
Published: 2025-09-16
Description: Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 143 and Thunderbird 143.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-290
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1974025; https://www.mozilla.org/security/advisories/mfsa2025-73/; https://www.mozilla.org/security/advisories/mfsa2025-77/
CVE: CVE-2025-10531
Published: 2025-09-16
Description: Mitigation bypass in the Web Compatibility: Tooling component. This vulnerability was fixed in Firefox 143 and Thunderbird 143.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-288
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1978453; https://www.mozilla.org/security/advisories/mfsa2025-73/; https://www.mozilla.org/security/advisories/mfsa2025-77/
CVE: CVE-2025-10532
Published: 2025-09-16
Description: Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-754
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1979502; https://www.mozilla.org/security/advisories/mfsa2025-73/; https://www.mozilla.org/security/advisories/mfsa2025-75/
CVE: CVE-2025-10533
Published: 2025-09-16
Description: Integer overflow in the SVG component. This vulnerability was fixed in Firefox 143, Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1980788; https://www.mozilla.org/security/advisories/mfsa2025-73/; https://www.mozilla.org/security/advisories/mfsa2025-74/
CVE: CVE-2025-10534
Published: 2025-09-16
Description: Spoofing issue in the Site Permissions component. This vulnerability was fixed in Firefox 143 and Thunderbird 143.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1665334; https://www.mozilla.org/security/advisories/mfsa2025-73/; https://www.mozilla.org/security/advisories/mfsa2025-77/
CVE: CVE-2025-10535
Published: 2025-09-16
Description: Information disclosure, mitigation bypass in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 143.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1979918; https://www.mozilla.org/security/advisories/mfsa2025-73/
CVE: CVE-2025-10536
Published: 2025-09-16
Description: Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1981502; https://www.mozilla.org/security/advisories/mfsa2025-73/; https://www.mozilla.org/security/advisories/mfsa2025-75/
CVE: CVE-2025-10537
Published: 2025-09-16
Description: Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1938220%2C1980730%2C1981280%2C1981283%2C1984505%2C1985067; https://www.mozilla.org/security/advisories/mfsa2025-73/; https://www.mozilla.org/security/advisories/mfsa2025-75/
CVE: CVE-2025-10546
Published: 2025-09-16
Description: This vulnerability exist in PPC 2K15X Router, due to improper input validation for the Common Gateway Interface (CGI) parameters at its web management portal. A remote attacker could exploit this vulnerability by injecting malicious JavaScript into the vulnerable parameter, leading to a reflected Cross-Site Scripting (XSS) attack on the targeted system.
CWE: CWE-79
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0215