CVE-2025-66222 DeepChat Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE)

DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting XSS vulnerability in the Mermaid diagram renderer allows an attacker to execute arbitrary JavaScript within the application context. By leveraging the exposed Electron IPC...

EUVD-2025-201091

DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting XSS vulnerability in the Mermaid diagram renderer allows an attacker to execute arbitrary JavaScript within the application context. By leveraging the exposed Electron IPC...

CVE-2025-66222

DeepChat (0.5.0 and earlier) is affected by a Stored XSS in the Mermaid diagram renderer, exploitable via the Electron IPC bridge to escalate to RCE by starting a malicious MCP server. Affected product/version: DeepChat prior to 0.5.0. Root cause: XSS within Mermaid rendering allows arbitrary Jav...

CVE-2025-66222 DeepChat Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE)

DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting XSS vulnerability in the Mermaid diagram renderer allows an attacker to execute arbitrary JavaScript within the application context. By leveraging the exposed Electron IPC...

PT-2025-48981

Name of the Vulnerable Software and Affected Versions DeepChat versions prior to 0.5.0 Description DeepChat, an AI smart assistant, contains a Stored Cross-Site Scripting XSS issue within the Mermaid diagram renderer. This allows an attacker to execute arbitrary JavaScript code within the...

PT-2025-47515

Name of the Vulnerable Software and Affected Versions bridgetech VBC Server & Element Manager versions 6.5.0-9 through 6.5.0-10 Description A stored cross-site scripting issue exists in bridgetech VBC Server & Element Manager. Successful exploitation allows attackers to execute arbitrary code. Th...

HPE Aruba Networking 100 Series Cellular Bridge 安全漏洞

The HPE Aruba Networking 100 Series Cellular Bridge is a 5G/4G mobile network wireless bridge device from HPE America. A security vulnerability exists in the HPE Aruba Networking 100 Series Cellular Bridge that stems from a command injection vulnerability in the command line interface that could...

HPESBNW04970 rev.1 - HPE Aruba Networking 100 Series Cellular Bridge, Multiple Vulnerabilities

Potential Security Impact: Remote: Code Execution, Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba 100 Series Access Points : Please refer to the Vulnerability Summary section for impacted versions. Affected Products HPE Aruba Networking 100 Series...

HPE Aruba Networking 100 Series Cellular Bridge 安全漏洞

HPE Aruba Networking 100 Series Cellular Bridge is a 5G/4G mobile network wireless bridge device from HPE America. A security vulnerability exists in the HPE Aruba Networking 100 Series Cellular Bridge that stems from a denial-of-service vulnerability in the web-based management interface, which...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990823)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990823 advisory. In the Linux kernel, the following vulnerability has been resolved: PCI: Add missing bridge lock to pcibuslock One of the true positives that the cfgaccesslock...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990782)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990782 advisory. In the Linux kernel, the following vulnerability has been resolved: bridge: switchdev: Fix memory leaks when changing VLAN protocol The bridge driver can offload VLA...

kernel: net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.

In the Linux kernel, the following vulnerability has been resolved: net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. SIOCBRDELIF is passed to devioctl first and later forwarded to brioctlcall, which causes unnecessary RTNL dance and the splat below 0 under RTNL pressure. Let's say Thread A...

kernel: net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.

In the Linux kernel, the following vulnerability has been resolved: net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. SIOCBRDELIF is passed to devioctl first and later forwarded to brioctlcall, which causes unnecessary RTNL dance and the splat below 0 under RTNL pressure. Let's say Thread A...

VulnCheck KEV: CVE-2024-54006

Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execution. Successful exploitation of these vulnerabilities result in the ability of an attacker to execute arbitrary commands as a privileged...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989168)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989168 advisory. In the Linux kernel, the following vulnerability has been resolved: nvdimm: Fix firmware activation deadlock scenarios Lockdep reports the following deadlock...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988716)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988716 advisory. In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix vlan tunnel dst null pointer dereference This patch fixes a tunneldst null point...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988845)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988845 advisory. In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix vlan tunnel dst refcnt when egressing The egress tunnel code uses dstclone and...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988935)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988935 advisory. In the Linux kernel, the following vulnerability has been resolved: misc: alcorpci: fix null-ptr-deref when there is no PCI bridge There is an issue with the...

Malicious code in tailwind-fa-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a756b361c16672e64c2930a0808516a83e75a9b441f30ac8e9e933a2b0a89858 The package tailwind-fa-bridge was found to contain malicious code. Source: ghsa-malware...

MAL-2025-49354 Malicious code in tailwind-fa-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a756b361c16672e64c2930a0808516a83e75a9b441f30ac8e9e933a2b0a89858 The package tailwind-fa-bridge was found to contain malicious code. Source: ghsa-malware...