Aggregator

Submit #646976 / VDB-324476

A vulnerability marked as problematic has been reported in Mozilla Firefox up to 142. Impacted is an unknown function. The manipulation leads to privilege escalation. This vulnerability is documented as CVE-2025-10528. The attack requires being on the local network. There is not any exploit available. It is suggested to upgrade the affected component.

NASA 韦伯太空望远镜捕捉到一股长达 8 光年的原恒星喷流，源自一颗质量约为太阳十倍的原恒星，位于距离地球约 1 万 5 千光年的 Sharpless 2-284 星云。这股喷流以每小时数十万至百万公里的速度横扫太空，对称且笔直，宛如《星际大战》的双刃光剑。如此庞大而强劲的喷流在恒星形成领域极为罕见。韦伯红外线影像显示，喷流具有丝状结构，正在冲击星际尘埃与气体，形成结点与弓形激波。这股喷流长度显示原恒星已持续活动约十万年。最远端的结构对应最早喷出的物质，而靠近核心的则是较近期的物质喷发。一般而言，大质量恒星的喷流规模与强度会随中心恒星质量的增加而放大，这次观测正好提供了一个清晰的例子。 Sharpless 2-284 星云位于银河系边缘，金属量低，环境条件类似早期宇宙，在此环境下形成的大质量恒星，能帮助我们理解宇宙初期恒星与星系的演化。

A vulnerability labeled as problematic has been found in Mozilla Firefox up to 142. This issue affects some unknown processing. Executing manipulation can lead to privilege escalation. This vulnerability is registered as CVE-2025-10527. The attack requires access to the local network. No exploit is available. The affected component should be upgraded.

A vulnerability identified as problematic has been detected in PPC XPON ONT 2K15X 1.0.3/2.3.15PPCL. This vulnerability affects unknown code of the component Common Gateway Interface. Performing manipulation results in cross site scripting. This vulnerability is cataloged as CVE-2025-10546. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability categorized as critical has been discovered in BMC Control-M and Agent 9.0.18/9.0.19/9.0.20. This affects an unknown part. Such manipulation leads to stack-based buffer overflow. This vulnerability is listed as CVE-2025-55116. The attack must be carried out locally. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability was found in BMC Control-M and Agent 9.0.18/9.0.19/9.0.20. It has been rated as problematic. Affected by this issue is some unknown functionality. This manipulation causes relative path traversal. This vulnerability is tracked as CVE-2025-55115. The attack is restricted to local execution. No exploit exists. Upgrading the affected component is advised.

A vulnerability was found in BMC Control-M and Agent 9.0.18/9.0.19/9.0.20. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component SSL File Parser. The manipulation results in incorrect default permissions. This vulnerability is identified as CVE-2025-55111. The attack is only possible with local access. There is not any exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Beefull Energy Beefull App. It has been classified as problematic. Affected is an unknown function. The manipulation leads to authorization bypass. This vulnerability is referenced as CVE-2025-7355. Remote exploitation of the attack is possible. No exploit is available. This product is a managed service. This means that users cannot maintain vulnerability countermeasures themselves. Upgrading the affected component is recommended.

A vulnerability was found in Mozilla Focus up to 142.x on iOS and classified as problematic. This impacts an unknown function. Executing manipulation can lead to improper restriction of rendered ui layers. The identification of this vulnerability is CVE-2025-10290. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability has been found in Frappe ERPNext 15.57.5 and classified as critical. This affects the function get_stock_balance of the file erpnext/stock/utils.py. Performing manipulation of the argument inventory_dimensions_dict results in sql injection. This vulnerability was named CVE-2025-52044. The attack may be initiated remotely. There is no available exploit.

The KillSec ransomware strain has rapidly emerged as a formidable threat targeting healthcare IT infrastructures across Latin America and beyond. First observed in early September 2025, KillSec operators have leveraged compromised software supply chain relationships to deploy their payloads at scale. Initial indicators of compromise were detected when several Brazilian healthcare providers reported unusual network […]

The post KillSec Ransomware Attacking Healthcare Industry IT Systems appeared first on Cyber Security News.

A vulnerability, which was classified as critical, was found in oa_system oasys 1.1. The impacted element is an unknown function of the file src/main/Java/cn/gson/oasys/controller/address/AddrController. Such manipulation of the argument alph leads to sql injection. This vulnerability is uniquely identified as CVE-2025-44034. The attack can be launched remotely. No exploit exists.

A vulnerability, which was classified as critical, has been found in Online Library Management System 3.0. The affected element is the function Login of the file adminlogin.php. This manipulation causes privilege escalation. This vulnerability is handled as CVE-2025-57119. The attack can only be done within the local network. There is not any exploit available.

A vulnerability classified as critical was found in BMC Control-M and Agent 9.0.18/9.0.19/9.0.20/9.0.21/9.0.22.000. Impacted is an unknown function. The manipulation results in heap-based buffer overflow. This vulnerability is known as CVE-2025-55118. It is possible to launch the attack remotely. No exploit is available.

A vulnerability classified as critical has been found in Linux Kernel up to 6.1.149/6.6.103/6.12.44/6.16.4/6.17-rc3. This issue affects the function rose_rt_free of the component net. The manipulation leads to improper update of reference count. This vulnerability is traded as CVE-2025-39827. Access to the local network is required for this attack to succeed. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability described as critical has been identified in BMC Control-M and Agent 9.0.18/9.0.19/9.0.20/9.0.21/9.0.22.000. This vulnerability affects unknown code of the component Error Message Handler. Executing manipulation can lead to stack-based buffer overflow. This vulnerability appears as CVE-2025-55117. The attack may be performed from remote. There is no available exploit.

A vulnerability marked as critical has been reported in Linux Kernel up to 6.12.44/6.16.4/6.17-rc2. This affects the function ftrace_suspend_notifier_call of the component fgraph. Performing manipulation results in information disclosure. This vulnerability is reported as CVE-2025-39829. The attacker must have access to the local network to execute the attack. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability labeled as critical has been found in Linux Kernel up to 6.17-rc3. Affected by this issue is the function atmtcp_recv_control of the component Special Message Handler. Such manipulation leads to insufficient verification of data authenticity. This vulnerability is documented as CVE-2025-39828. The attack requires being on the local network. There is not any exploit available. The affected component should be upgraded.

At least 187 code packages made available through the JavaScript repository NPM have been infected with a self-replicating worm that steals credentials from developers and publishes those secrets on GitHub, experts warn. The malware, which briefly infected multiple code packages from the security vendor CrowdStrike, steals and publishes even more credentials every time an infected package is installed.