Microsoft May 2025 Security Updates

Microsoft May Early 2025 Security Updates

Microsoft April 2025 Security Updates

Microsoft March 2025 Security Updates

Microsoft March 2025 Early Security Updates

Microsoft February 2025 Security Updates

Microsoft February 2025 Early Security Updates

Microsoft January 2025 Security Updates

Microsoft January 2025 Early Security Updates

Microsoft December 2024 Security Updates

Microsoft November 2024 Security Updates

Microsoft October 2024 Security Updates

Microsoft September 2024 Security Updates

Microsoft August 2024 Security Updates

Microsoft July 2024 Security Updates

Microsoft June 2024 Security Updates

Microsoft May 2024 Security Updates

Microsoft April 2024 Security Updates

Microsoft March 2024 Security Updates

Microsoft February 2024 Security Updates

Microsoft January 2024 Security Updates

chrome

Out-of-bounds Write

[Severity: High]
Out of bounds read and write in V8. Reported by Clement Lecigne and Benoît Sevens of Google Threat Analysis Group on 2025-05-27. This issue was mitigated on 2025-05-28 by a configuration change pushed out to Stable across all Chrome platforms.

Google Chrome update, version 137.0.7151.68 fixes the following vulnerabilities.

Out of bounds read and write vulnerability in V8 JavaScript engine of Google Chrome. The vulnerability allows an attacker to potentially manipulate memory outside of intended bounds, which could lead to code execution or system compromise.

Google Chrome chrome-137.0.7151.68

bugzilla.redhat.com

Improper Authentication

An authentication bypass vulnerability exists in HPE StoreOnce Software.

Authentication bypass vulnerability in HPE StoreOnce Software that allows unauthorized access to the system

Authentication Abuse

Authentication Bypass

Identity Spoofing

Fake the Source of Data

Exploiting Trust in Client

Utilizing REST's Trust in the System Resource to Obtain Sensitive Data

Session Hijacking

Token Impersonation

Upload a Web Shell to a Web Server

Adversary in the Middle (AiTM)

Abuse Elevation Control Mechanism

Application Access Token

Access Token Manipulation

Web Shell

Adversary-in-the-Middle

golo

wordpress

Authentication Bypass Using an Alternate Path or Channel

The Golo - City Travel Guide WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.7.0. This is due to the plugin not properly validating a user's identity prior to setting an authorization cookie. This makes it possible for unauthenticated attackers to log in as any user, including administrators, provided they know the user's email address.

A critical vulnerability in the Golo - City Travel Guide WordPress Theme affects all versions up to and including 1.7.0. The vulnerability stems from improper user identity validation when setting authorization cookies, allowing unauthenticated attackers to log in as any user, including administrators, by knowing the target user's email address.

Directory Indexing

Exploitation of Thunderbolt Protection Flaws

File and Directory Discovery

Firmware Corruption

Exploitation for Defense Evasion

Modify Authentication Process

webmail

Deserialization of Untrusted Data

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

Vulnerability in Roundcube Webmail affecting versions before 1.5.10 and 1.6.x before 1.6.11. The vulnerability exists in the program/actions/settings/upload.php file, where the _from parameter in a URL is not properly validated, leading to PHP Object Deserialization.

Object Injection

delmia_apriso

A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025Â could lead to a remote code execution.

A deserialization of untrusted data vulnerability in DELMIA Apriso from Release 2020 through Release 2025 that enables remote code execution

tar-fs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories.

A path traversal vulnerability in tar-fs, a filesystem binding for tar-stream, allows an attacker to write files outside the intended directory using a specially crafted tarball. Affected versions are prior to 3.0.9, 2.1.3, and 1.16.5.

Path Traversal

Using Slashes and URL Encoding Combined to Bypass Validation Logic

Manipulating Web Input to File System Calls

Using Escaped Slashes in Alternate Encoding

Using Slashes in Alternate Encoding

Github Advisory

revit

Use After Free

A maliciously crafted RFA file, when linked or imported into Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

[Severity: Medium]
Use after free in Blink. Reported by Walkman on 2025-04-07

Google Chrome update, version 137.0.7151.68 fixes the following vulnerabilities.

Use after free vulnerability in Blink, a component of Google Chrome. This is a memory safety issue where the application continues to use memory after it has been freed, potentially allowing an attacker to manipulate memory operations.

Search CVEs by ID

Trending Vulnerabilities

Latest Patch Tuesday Reports

May 2025 Patch Tuesday: 10 Critical Vulnerabilities Amid 78 CVEs

May 2025 Early Security Update: 6 Critical Vulnerabilities Amid 7 CVEs

April 2025 Patch Tuesday: 10 Critical Vulnerabilities Amid 133 CVEs

Browse

Be the first to know about critical vulnerabilities