Security Bulletin: NVIDIA Jetson and IGX Devices - October 2025

NVIDIA has released a software update for NVIDIA® Jetson Linux. To protect your system, download and install this software update from the APT server or Jetson Download Center page, Jetson Linux Link and IGX Link. Go to NVIDIA Product Security...

CVE-2025-11648

A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. Impacted is an unknown function of the file TFFQDN.json of the component GATT Interface URL Handler. Such manipulation leads to server-side request forgery. The attack may be performed from remote. Attacks of this nature are high...

AMD CVE-2025-0033: RMP Corruption During SNP Initialization

Microsoft is aware of AMD-SB-3020 | CVE-2025-0033 disclosed by AMD on October 13, 2025. CVE-2025-0033 is a vulnerability in AMD EPYC processors using Secure Encrypted Virtualization – Secure Nested Paging SEV-SNP. It involves a race condition during Reverse Map Table RMP initialization that could...

Security update for bluez

This update for bluez fixes the following issues: CVE-2023-45866: keystroke injection and arbitrary command execution via HID device connections bsc1217877. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

EUVD-2025-34058

A vulnerability was detected in D-Link DAP-2695 2.00RC131. This affects the function fwupdatermain of the file rgbin of the component Firmware Update Handler. Performing manipulation results in os command injection. The attack may be initiated remotely. This vulnerability only affects products th...

CVE-2025-11665

A vulnerability was detected in D-Link DAP-2695 2.00RC131. This affects the function fwupdatermain of the file rgbin of the component Firmware Update Handler. Performing manipulation results in os command injection. The attack may be initiated remotely. This vulnerability only affects products th...

CVE-2025-11665 D-Link DAP-2695 Firmware Update rgbin fwupdater_main os command injection

A vulnerability was detected in D-Link DAP-2695 2.00RC131. This affects the function fwupdatermain of the file rgbin of the component Firmware Update Handler. Performing manipulation results in os command injection. The attack may be initiated remotely. This vulnerability only affects products th...

Malicious code in project-serum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c390d6d9b15f1fb2c2ad9b8e802cff831ed02b6028b111d2937705df46f3fdc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48336 Malicious code in mad-1.2.8.2.2.8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f458f275324cf68bed67b3ae284456b3688dfd9634450c5a03f39552352ea625 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-41795

Name of the Vulnerable Software and Affected Versions AMD EPYC and EPYC Embedded series processors versions prior to BIOS updates from OEM partners AMD EPYC processors using Secure Encrypted Virtualization – Secure Nested Paging SEV-SNP affected versions not specified Description A critical issue...

PT-2025-41759

Name of the Vulnerable Software and Affected Versions D-Link DAP-2695 version 2.00RC131 Description A flaw exists in the D-Link DAP-2695 related to the Firmware Update Handler component. Specifically, the fwupdater main function within the rgbin file is susceptible to os command injection. This...

Malicious code in nodelog-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c3f1413a6184e042f68d9e0cee79523ea3c0566535bb56e1e0b13370875fd8e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-ui-toast (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6789082e9bf3c52d9daaa6abb3f09ea5012ad93106de355e66a04ee1be9c6605 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48321 Malicious code in react-ui-toast (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6789082e9bf3c52d9daaa6abb3f09ea5012ad93106de355e66a04ee1be9c6605 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-11648

A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. Impacted is an unknown function of the file TFFQDN.json of the component GATT Interface URL Handler. Such manipulation leads to server-side request forgery. The attack may be performed from remote. Attacks of this nature are high...

CVE-2025-11646

CVE-2025-11646 affects Tomofun Furbo 360 (FB0035_FW_036 and earlier) and Furbo Mini (MC0020_FW_074 and earlier). The issue arises from improper access controls in the GATT Service component, enabling a local‑network attack. Public exploits are available. Remediation per PT Security advisory: upda...

CVE-2025-11644

A weakness has been identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is some unknown functionality of the component UART Interface. Executing manipulation can lead to insecure storage of sensitive information. The physical device can be targeted for the attack. This attack i...

CVE-2025-11641

A vulnerability was determined in Tomofun Furbo 360 and Furbo Mini. This impacts an unknown function of the component Trial Restriction Handler. This manipulation causes improper access controls. It is feasible to perform the attack on the physical device. The attack is considered to have high...

CVE-2025-11641 Tomofun Furbo 360/Furbo Mini Trial Restriction access control

A vulnerability was determined in Tomofun Furbo 360 and Furbo Mini. This impacts an unknown function of the component Trial Restriction Handler. This manipulation causes improper access controls. It is feasible to perform the attack on the physical device. The attack is considered to have high...

CVE-2025-11640

A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. This affects an unknown function of the component Bluetooth Low Energy. The manipulation results in cleartext transmission of sensitive information. Access to the local network is required for this attack. Attacks of this nature are...