The vulnerability of the setWiFiScheduleCfg() function in the web/cgi-bin/cstecgi.cgi script of the TOTOLINK X5000R router’s microprogramming software allows a perpetrator to execute arbitrary commands.

The vulnerability of the setWiFiScheduleCfg function in the web/cgi-bin/cstecgi.cgi script of the TOTOLINK X5000R router’s microprogramming system is related to the failure to take measures to neutralize special elements used in the operating system’s processing of the sHour parameter. Exploiting...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation through the auth-url annotation which can be used to inject configuration into nginx. Remediation Upgrade k8s.io/ingress-nginx/internal/ingress/annotations/auth to version 1.11.5, 1.12.1, 4.11.5, 4.12.1 or...

Improper Isolation or Compartmentalization

Overview Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization in the Validating Admission Controller feature. An attacker with access to the pod network can execute code, which allows them to access stored secrets. By default, the controller can access al...

CVE-2025-1098 ingress-nginx controller - configuration injection via unsanitized mirror annotations

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the mirror-target and mirror-host Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx...

CLSA-2025-1742805183 grub2: Fix of 5 CVEs

CVE-2025-0624: net: Out-of-bounds write in grubnetsearchconfigfile - CVE-2025-0690: read: Integer overflow may lead to out-of-bounds write - CVE-2025-1118: commands/dump: The dump command is not in lockdown when secure boot is enabled - CVE-2025-0678: squash4: Integer overflow may lead to heap...

The vulnerability of the lpi2c_imx_config() function in the drivers/i2c/busses/i2c-imx-lpi2c.c module of the Linux kernel allows a hacker to cause a service failure.

The vulnerability of the lpi2cimxconfig function in the drivers/i2c/busses/i2c-imx-lpi2c.c module of the Linux kernel is related to insufficient resource locking. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2024-11037

A path traversal vulnerability exists in binary-husky/gptacademic at commit 679352d, which allows an attacker to bypass the blockedpaths protection and read the config.py file containing sensitive information such as the OpenAI API key. This vulnerability is exploitable on Windows operating syste...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the ProcessorYaml class, whose processor method deserializes YAML without checking/sanitizing its content. Details Serialization is a process of converting an object into a sequence of bytes which ca...

PT-2025-25846

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A divide error occurs in the libnvdimm driver when a faulty CXL memory device returns a broken zero LSA size in its memory device information. This error happens because the config size ...

GPT Academic 路径遍历漏洞

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a path traversal vulnerability that can be exploited to cause an attacker to read a config.py file containing sensitive information...

MAL-2025-2541 Malicious code in yellowcard-styling-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 12dee9a88b4f374a8db73de73d255757719bcc1d3124dfe2599b3dbfe3a49d6d This package installs a dependency hosted on a custom domain that runs an info stealer during installation. The info stealer focuses on...

Information Disclosure

parse-git-config is vulnerable to information disclosure. The vulnerability is due to improper handling of key expansion in the expandKeys function, allows an attacker to obtain sensitive information...

PT-2025-18415

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved. The issue is related to the access of the PCI config space via pci ops::read and pci ops::write, which are low-level hardware...

CVE-2025-25585

Incorrect access control in the component /config/WebSecurityConfig.java of yimioa before v2024.07.04 allows unauthorized attackers to arbitrarily modify Administrator passwords...

redhat-rpm-config bug fix and enhancement update

An update is available for redhat-rpm-config. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

accel-config bug fix and enhancement update

An update is available for accel-config. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux...

Malicious code in eslint8_flat_config_mjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea965fc719f78ae7eb9148cb5a4cd65ee8a06887968868fee8558dbff3faff00 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-25975

A flaw was found in the parse-git-config package. Affected versions of this package allow an attacker to obtain sensitive information via the expandKeys function...

Malicious code in eslint-config-dx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17d0a9a27ae607e3c566576cc74707e5a5bc3447a3cce8535fc8ffd18c396936 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2382 Malicious code in eslint-config-dx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17d0a9a27ae607e3c566576cc74707e5a5bc3447a3cce8535fc8ffd18c396936 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...