Cudy TR1200 代码注入漏洞

The Cudy TR1200 is a router from the Chinese company Cudy. A code injection vulnerability exists in the Cudy TR1200 version 1.16.3-20230804-164635, which stems from incorrect manipulation of the parameter SSID in the file /cgi-bin/luci/admin/network/wireless/config, which could lead to a cross-si...

CVE-2025-11120

A weakness has been identified in Tenda AC8 16.03.34.06. The affected element is the function formSetServerConfig of the file /goform/SetServerConfig. Executing manipulation can lead to buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the publi...

CVE-2025-11120 Tenda AC8 SetServerConfig formSetServerConfig buffer overflow

A weakness has been identified in Tenda AC8 16.03.34.06. The affected element is the function formSetServerConfig of the file /goform/SetServerConfig. Executing manipulation can lead to buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the publi...

PT-2025-39791

Name of the Vulnerable Software and Affected Versions Tenda AC8 version 16.03.34.06 Description A flaw exists in the formSetServerConfig function located in the /goform/SetServerConfig file. This can lead to a buffer overflow, potentially allowing for remote attacks. A public exploit is available...

Arbitrary code execution during YAML config parsing in Kubernetes materializer

Summary The Kubernetes materializer entry point feast/sdk/python/feast/infra/computeengines/kubernetes/main.py deserializes /var/feast/featurestore.yaml and /var/feast/materializationconfig.yaml using yaml.load..., Loader=yaml.Loader. Because yaml.Loader eagerly instantiates arbitrary Python...

CVE-2025-35027

CVE-2025-35027 affects Unitree Go2, G1, H1, and B2 robotic devices sharing a common firmware (MIT Cheetah). It enables command injection by supplying a malicious string during BLE-configured WiFi setup and triggering a WiFi service restart, allowing commands to run as root via the wpa_supplicant_...

Malicious code in node-melitk-config (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88dc6316252ef33fdae8980d00eb9ac549ca8913087ed5ca7bf8eb8fac6e5f34 Any computer that has this package installed or running should be considered...

MAL-2025-47854 Malicious code in node-melitk-config (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88dc6316252ef33fdae8980d00eb9ac549ca8913087ed5ca7bf8eb8fac6e5f34 Any computer that has this package installed or running should be considered...

Fortinet FortiWeb _cmf_get_config_file_path Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Fortinet FortiWeb. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the cmfgetconfigfilepath method. The issue results from the...

CVE-2025-59817

CVE-2025-59817 is an authenticated remote code execution affecting Zenitel ICX500/ICX510 gateways (zForm_auto_config). The vulnerability allows an authenticated attacker to execute arbitrary commands on the device; the web portal runs with root privileges, enabling full control and impacting avai...

CVE-2025-27037

Memory corruption while processing configdev IOCTL when camera kernel driver drops its reference to CPU buffers...

MAL-2025-47599 Malicious code in stylelint-config-opbox (npm)

The package stylelint-config-opbox was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 7e02ca16874e3af9774a4294f961e0306827965e363fbb56bcc1b4eb028857a3 This package installs a dependency hosted on a custom domain that...

Malicious code in stylelint-config-opbox (npm)

The package stylelint-config-opbox was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 7e02ca16874e3af9774a4294f961e0306827965e363fbb56bcc1b4eb028857a3 This package installs a dependency hosted on a custom domain that...

Improper Validation of Specified Quantity in Input

Overview torch is a Tensors and Dynamic neural networks in Python with strong GPU acceleration Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the ModularIndexing function when Inductor config is set to constantandindexpropagation=False. A...

CVE-2025-36857 Rapid7 Appspider Broken Access Control Vulnerability

Rapid7 Appspider Pro versions below 7.5.021, suffer from a broken access control vulnerability in the application's configuration file loading mechanism, whereby an attacker can place files in directories belonging to other users or projects. Affected versions allow standard users to add custom...

podman: Podman kube play command may overwrite host files

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the targ...

Malicious Package

Overview @sev-ui-verse/i18next-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in @sev-ui-verse/i18next-config (npm)

The package @sev-ui-verse/i18next-config was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0a4074d88681a40324dc4f76ce6e6339cb36c218478b433434a961e47adfac2 Any computer that has this package installed or running should be considere...

MAL-2025-47539 Malicious code in @sev-ui-verse/i18next-config (npm)

The package @sev-ui-verse/i18next-config was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0a4074d88681a40324dc4f76ce6e6339cb36c218478b433434a961e47adfac2 Any computer that has this package installed or running should be considere...

Malicious code in dotenvx-config (npm)

The package dotenvx-config was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1b17bc0067221fd1c252545277d6c9462a5c5ef95cfcdf96f7e320699387861 Any computer that has this package installed or running should be considered fully...