Vulnerability (CVE)
Popular browser password manager plugins were found vulnerable to a technique researcher Marek Tóth calls DOM-based extension clickjacking, which could be exploited to steal credentials, 2FA codes, and credit card details, and was presented at DEF CON 33....
Apache Tika carries a maximum-severity XXE flaw, CVE-2025-66516, rated 10.0 on the CVSS scale, affecting tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5), where a crafted XFA file inside a PDF lets an attacker trigger...
Fortinet confirmed fresh exploitation of an incomplete patch for CVE-2025-59718 and CVE-2025-59719, an authentication bypass via crafted SAML messages that hit devices fully upgraded to the latest release when FortiCloud SSO was enabled. The same recap...