JLSEC-2025-101 FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcode...

FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbsav1.c that can result in Denial of service. This attack appears to be exploitable via specially crafted AV1 file has to be provided as input. This vulnerability appears to have been fixed in...

OESA-2025-2402 libtiff security update

This provides support for the Tag Image File Format TIFF, a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff...

An AUTOSAR-Aligned Architectural Study of Vulnerabilities in Automotive SoC Software

Cooperative, Connected and Automated Mobility CCAM are complex cyber-physical systems CPS that integrate computation, communication, and control in safety-critical environments. At their core, System-on-Chip SoC platforms consolidate processing units, communication interfaces, AI accelerators, an...

EUVD-2025-27426

Malicious code in bioql PyPI...

EUVD-2025-27423

Malicious code in bioql PyPI...

EUVD-2025-27432

Malicious code in bioql PyPI...

EUVD-2025-27428

Malicious code in bioql PyPI...

EUVD-2025-26519

Malicious code in bioql PyPI...

A Systematic Evaluation of Parameter-Efficient Fine-Tuning Methods for the Security of Code LLMs

Code-generating Large Language Models LLMs significantly accelerate software development. However, their frequent generation of insecure code presents serious risks. We present a comprehensive evaluation of seven parameter-efficient fine-tuning PEFT techniques, demonstrating substantial gains in...

CVE-2025-55047

CWE-798 Use of Hard-coded Credentials...

CVE-2025-55051

CVE-2025-55051 corresponds to CWE-1392 (Use of Default Credentials) with a CVSSv3.1 base score 10.0 (CRITICAL, NETWORK, no user interaction) affecting Baicells devices: Nova436Q; Nova430e/430i; NEUTRINO430; NOVA846. Root cause stated: default credentials being used leads to security feature bypas...

CVE-2025-55047

Baicells SPECTRA LTE-U eNB outdoor base station is affected by a trust management issue described as hard-coded credentials (CVE-2025-55047). Root cause: hard-coded credentials leading to potential security feature bypass. Impact: unauthorized access or bypass of security features as indicated by...

PT-2025-36923

Name of the Vulnerable Software and Affected Versions: affected versions not specified Description: The software utilizes a default cryptographic key. This practice compromises the security of the system, as the key is publicly known and can be exploited by malicious actors to gain unauthorized...

PT-2025-36925

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. affected versions not specified Description: The issue involves the use of default credentials. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...

VulRTex: a Reasoning-Guided Approach to Identify Vulnerabilities from Rich-Text Issue Report

Software vulnerabilities exist in open-source software OSS, and the developers who discover these vulnerabilities may submit issue reports IRs to describe their details. Security practitioners need to spend a lot of time manually identifying vulnerability-related IRs from the community, and the...

An Empirical Study of Vulnerabilities in Python Packages and Their Detection

In the rapidly evolving software development landscape, Python stands out for its simplicity, versatility, and extensive ecosystem. Python packages, as units of organization, reusability, and distribution, have become a pressing concern, highlighted by the considerable number of vulnerability...

CVE-2025-56608

The CVE-2025-56608 entry concerns the SourceCodester Android app “Corona Virus Tracker App India” v1.0. The issue is in OkHttpClientWrapper.java, where handleDigest() hashes credentials with MD5 via MessageDigest.getInstance("MD5"). MD5 is used for digest authentication, introducing weaknesses su...

CVE-2025-54199 Substance3D - Modeler | Out-of-bounds Read (CWE-125)

Substance3D - Modeler versions 1.22.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2025-32766

A stack-based buffer overflow vulnerability CWE-121 in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before 7.4.8 allows a privileged attacker to execute arbitrary code or commands via crafted CLI commands...

CVE-2025-49813

CVE-2025-49813 describes an OS Command Injection in Fortinet FortiADC. The vulnerability arises from improper neutralization of special elements in OS commands, affecting FortiADC versions 7.2.0 and earlier than 7.1.1. An authenticated, low-privilege remote attacker can craft HTTP parameters to e...