Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
openSUSE Leap 15.4: 2025:01904-1 moderate: yelp JavaScript issue
Debian LTS: DLA-3886-1: nodejs Security Advisory Updates
Node.js a JavaScript runtime environment that executes JavaScript code outside a web browser (server side) was vulnerable. CVE-2023-30589
Actively Exploited Chromium V8 Zero-Day: What Linux Admins Need to Know
CISA added CVE-2026-11645 to its Known Exploited Vulnerabilities catalog after Google confirmed active exploitation of the flaw. The bug sits in V8, the JavaSc…
Fedora 43 openQA Critical CVE-2025-13465 Prototype Pollution Advisory
This update provides new upstream snapshots of openQA and os-autoinst, with various fixes and enhancements. Please see upstream changelogs for details. They al…
Debian LTS: DLA-4067-1: nodejs Security Advisory Updates
Node.js a JavaScript runtime environment was affected by a vulnerability. A memory leak could occur when a remote peer abruptly closes the socket without sendi…
CISA Adds Five-Year-Old jQuery XSS Flaw to Exploited Vulnerabilities List
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday placed a now-patched security flaw impacting the popular jQuery JavaScript library…
Debian LTS: DLA-4013-1: node-mocha Security Advisory Updates
mocha a javascript test framework was affected by two vulnerabilities in nanoid component.
Debian LTS: DLA-3956-1: smarty3 Security Advisory Updates
Multiple vulnerabilties were discovered for smarty3, a widely-used PHP templating engine, which potentially allows an attacker to perform an XSS (e.g JavaScrip…
Mageia 2024-0314: gnome-shell Security Advisory Updates
In GNOME Shell through 45.7, a portal helper can be launched automatically (without user confirmation) based on network responses provided by an adversary (e.g…
Google Warns of CVE-2024-7965 Chrome Security Flaw Under Active Exploitation
Google has revealed that a security flaw that was patched as part of a software update rolled out last week to its Chrome browser has come under active exploit…
Debian LTS: DLA-3856-1: python-html-sanitizer Security Advisory Updates
It was discovered that there was a sanitisation bypass issue in python-html-sanitizer, a library used ensure that user-specified content cannot inject HTML or …
Mageia 2024-0256: python-js2py Security Advisory Updates
CVE-2024-28397: Fixed a potential sandbox escape via untrusted JavaScript code References: - https://bugs.mageia.org/show_bug.cgi?id=33354
Mageia 2024-0231: thunderbird Security Advisory Updates
Use-after-free in networking. (CVE-2024-5702) Use-after-free in JavaScript object transplant. (CVE-2024-5688) External protocol handlers leaked by timing attac…
Debian LTS: DLA-3835-1: roundcube Security Advisory Updates
Cross-site scripting (XSS) vulnerabilities were discovered in Roundcube, a skinnable AJAX based webmail solution for IMAP servers, which could allow a remote a…
Mageia 2024-0222: nss & firefox Security Advisory Updates
Use-after-free in networking. (CVE-2024-5702) Use-after-free in JavaScript object transplant. (CVE-2024-5688) External protocol handlers leaked by timing attac…
Mageia 2024-0191: thunderbird Security Advisory Updates
Arbitrary JavaScript execution in PDF.js. (CVE-2024-4367) IndexedDB files retained in private browsing mode. (CVE-2024-4767) Potential permissions request bypa…
Mageia 2024-0189: nss & firefox Security Advisory Updates
Arbitrary JavaScript execution in PDF.js. (CVE-2024-4367) IndexedDB files retained in private browsing mode. (CVE-2024-4767) Potential permissions request bypa…
CERT-UA Warns of SmokeLoader and RoarBAT Malware Attacks Against Ukraine
An ongoing phishing campaign with invoice-themed lures is being used to distribute the SmokeLoader malware in the form of a polyglot file, according to the Com…