Veille CVE

Septembre 2025

7 CVE sur 33

Critique 10 Élevée 16 Moyenne 7 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2025-59689 6.1 Moyenne Exploitée

    Libraesva Email Security Gateway

    Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5. a fix has been released in 5.5.7.

  2. CVE-2025-10536 6.2 Moyenne

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

  3. CVE-2025-10532 6.5 Moyenne

    Mozilla Firefox · Mozilla Thunderbird

    Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

  4. CVE-2025-10529 6.5 Moyenne

    Mozilla Firefox · Mozilla Thunderbird

    Same-origin policy bypass in the Layout component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

  5. CVE-2025-10290 6.5 Moyenne

    Mozilla Focus for iOS · Mozilla firefox focus

    Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers to spoof websites if users were coerced into opening a link explicitly through a long-press. This vulnerability was fixed in Focus for iOS 143.0.

  6. CVE-2025-41713 6.5 Moyenne

    WAGO CC100 0751-9301 · WAGO CC100 0751-9301 HW rev. <082100 · WAGO CC100 0751-9301/K000-0005 · WAGO CC100 0751-9301/K000-0005 HW rev. <082100

    During a short time frame while the device is booting an unauthenticated remote attacker can send traffic to unauthorized networks due to the switch operating in an undefined state until a CPU-induced reset allows proper configuration.

  7. CVE-2025-52546 6.1 Moyenne

    Copeland LP E3 Supervisory Control · Copeland e3 supervisory controller firmware

    E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can inject a stored XSS to the floorplan web page.