CVSS: 9.0EPSS: 0%CPEs: 34EXPL: 0CVE-2025-1931 – firefox: Use-after-free in WebTransportChild
https://notcve.org/view.php?id=CVE-2025-1931
04 Mar 2025 — It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash. This vulnerability affects Firefox < 136, Firefox ESR < 115.21, and Firefox ESR < 128.8. It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash. This vulnerability affects Firefox < 136, Firefox ESR < 115.21, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8. Multip... • https://bugzilla.mozilla.org/show_bug.cgi?id=1944126 • CWE-416: Use After Free •
CVSS: 5.9EPSS: 14%CPEs: 11EXPL: 3CVE-2025-26466 – Openssh: denial-of-service in openssh
https://notcve.org/view.php?id=CVE-2025-26466
18 Feb 2025 — A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack. • https://github.com/rxerium/CVE-2025-26466 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.1EPSS: 8%CPEs: 20EXPL: 2CVE-2025-26465 – Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled
https://notcve.org/view.php?id=CVE-2025-26465
18 Feb 2025 — A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high. It was discovered that the OpenSSH client incorrectly handled ... • https://github.com/rxerium/CVE-2025-26465 • CWE-390: Detection of Error Condition Without Action •
CVSS: 8.1EPSS: 84%CPEs: 14EXPL: 4CVE-2025-1094 – PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation
https://notcve.org/view.php?id=CVE-2025-1094
13 Feb 2025 — Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command li... • https://packetstorm.news/files/id/189316 • CWE-149: Improper Neutralization of Quoting Syntax •
CVSS: 5.6EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31068 – Ubuntu Security Notice USN-7269-1
https://notcve.org/view.php?id=CVE-2024-31068
12 Feb 2025 — Improper Finite State Machines (FSMs) in Hardware Logic for some Intel(R) Processors may allow privileged user to potentially enable denial of service via local access. Ke Sun, Paul Grosen and Alyssa Milburn discovered that some Intel® Processors did not properly implement Finite State Machines in Hardware Logic. A local privileged attacker could use this issue to cause a denial of service. It was discovered that some Intel® Processors with Intel® SGX did not properly restrict access to the EDECCSSA user le... • https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01166.html • CWE-1245: Improper Finite State Machines (FSMs) in Hardware Logic •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-36293 – Ubuntu Security Notice USN-7269-1
https://notcve.org/view.php?id=CVE-2024-36293
12 Feb 2025 — Improper access control in the EDECCSSA user leaf function for some Intel(R) Processors with Intel(R) SGX may allow an authenticated user to potentially enable denial of service via local access. Ke Sun, Paul Grosen and Alyssa Milburn discovered that some Intel® Processors did not properly implement Finite State Machines in Hardware Logic. A local privileged attacker could use this issue to cause a denial of service. It was discovered that some Intel® Processors with Intel® SGX did not properly restrict acc... • https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01213.html • CWE-284: Improper Access Control •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37020
https://notcve.org/view.php?id=CVE-2024-37020
12 Feb 2025 — Sequence of processor instructions leads to unexpected behavior in the Intel(R) DSA V1.0 for some Intel(R) Xeon(R) Processors may allow an authenticated user to potentially enable denial of service via local access. • https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01194.html • CWE-1281: Sequence of Processor Instructions Leads to Unexpected Behavior •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-39355
https://notcve.org/view.php?id=CVE-2024-39355
12 Feb 2025 — Improper handling of physical or environmental conditions in some Intel(R) Processors may allow an authenticated user to enable denial of service via local access. • https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01228.html • CWE-1384: Improper Handling of Physical or Environmental Conditions •
CVSS: 8.7EPSS: 0%CPEs: 1EXPL: 0CVE-2023-43758
https://notcve.org/view.php?id=CVE-2023-43758
12 Feb 2025 — Improper input validation in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privilege via local access. • https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 0%CPEs: 30EXPL: 0CVE-2025-1244 – Emacs: shell injection vulnerability in gnu emacs via custom "man" uri scheme
https://notcve.org/view.php?id=CVE-2025-1244
12 Feb 2025 — A flaw was found in the Emacs text editor. Improper handling of custom "man" URI schemes allows attackers to execute arbitrary shell commands by tricking users into visiting a specially crafted website or an HTTP URL with a redirect. A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a ... • https://access.redhat.com/security/cve/CVE-2025-1244 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •