CVE-2025-62600

CVE-2025-62600 affects eProsima Fast DDS prior to 2.6.11, 2.14.6, 3.2.4, 3.3.1, and 3.4.1. When security mode is enabled and a publisher sends a DATA Submessage in an SPDP packet, tampering with the length of PID_IDENTITY_TOKEN or PID_PERMISSION_TOKEN can cause an integer overflow during readBina...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the readPropertySeq function when handling manipulated DATA Submessages with tampered length fields in the PIDIDENTITYTOKEN or PIDPERMISSIONTOKEN fields. An attacker can cause a remote out-of-memory...

EUVD-2025-206690

Fast DDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group . Prior to versions 3.4.1, 3.3.1, and 2.6.11, when the security mode is enabled, modifying the DATA Submessage within an SPDP packet sent by a publisher causes an Out-Of-Memory OOM...

CVE-2025-62599

eprosima Fast DDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group. Prior to 2.6.11, 2.14.6, 3.2.4, 3.3.1, and 3.4.1, when the security mode is enabled, modifying the DATA Submessage within an SPDP packet sent by a publisher causes an...

CVE-2025-62599

CVE-2025-62599 affects eProsima Fast DDS prior to versions 2.6.11, 2.14.6, 3.2.4, 3.3.1, and 3.4.1. When security mode is enabled, modifying the DATA Submessage in an SPDP packet (specifically tampering with the length of PID_IDENTITY_TOKEN or PID_PERMISSION_TOKEN as readPropertySeq) can trigger ...

CVE-2025-62599 eprosima Fast DDS affected by Out-of-Memory in readPropertySeq via Manipulated DATA Submessage when DDS Security is enabled

eprosima Fast DDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group. Prior to 2.6.11, 2.14.6, 3.2.4, 3.3.1, and 3.4.1, when the security mode is enabled, modifying the DATA Submessage within an SPDP packet sent by a publisher causes an...

CVE-2025-62599 eprosima Fast DDS affected by Out-of-Memory in readPropertySeq via Manipulated DATA Submessage when DDS Security is enabled

eprosima Fast DDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group. Prior to 2.6.11, 2.14.6, 3.2.4, 3.3.1, and 3.4.1, when the security mode is enabled, modifying the DATA Submessage within an SPDP packet sent by a publisher causes an...

RustFS has SourceIp bypass via spoofed X-Forwarded-For/Real-IP headers

Summary IP-based access control can be bypassed: getconditionvalues trusts client-supplied X-Forwarded-For/X-Real-Ip without verifying a trusted proxy, so any reachable client can spoof aws:SourceIp and satisfy IP-allowlist policies. Details - Vulnerable code: rustfs/src/auth.rs:289-304 sets...

[R1] Tenable Identity Exposure Version 3.77.16 Fixes Multiple Vulnerabilities

R1 Tenable Identity Exposure Version 3.77.16 Fixes Multiple Vulnerabilities Arnie Cabral Tue, 02/03/2026 - 09:56 Tenable Identity Exposure leverages third-party software to help provide underlying functionality. One of the third-party components OpenSSL was found to contain vulnerabilities, and...

[R1] Tenable Identity Exposure Version 3.77.16 Fixes Multiple Vulnerabilities

R1 Tenable Identity Exposure Version 3.77.16 Fixes Multiple Vulnerabilities Arnie Cabral Tue, 02/03/2026 - 09:56 Tenable Identity Exposure leverages third-party software to help provide underlying functionality. One of the third-party components OpenSSL was found to contain vulnerabilities, and...

AT&T breach data resurfaces with new risks for customers

When data resurfaces, it never comes back weaker. A newly shared dataset tied to AT&T shows just how much more dangerous an “old” breach can become once criminals have enough of the right details to work with. The dataset, privately circulated since February 2, 2026, is described as AT&T customer...

When Cloud Outages Ripple Across the Internet

Recent major cloud service outages have been hard to miss. High-profile incidents affecting providers such as AWS, Azure, and Cloudflare have disrupted large parts of the internet, taking down websites and services that many other systems depend on. The resulting ripple effects have halted...

Improper TLS Certificate Validation

github.com/neuvector/neuvector is vulnerable to improper TLS certificate validation. The vulnerability is due to TLS verification not being enforced by default for OpenID Connect authentication, which allows an attacker to perform man-in-the-middle MITM attacks by intercepting or tampering with...

Fast-DDS input validation vulnerability

Fast-DDS is a complete DDS system open-sourced by eProsima. Versions of Fast-DDS prior to 3.4.1, 3.3.1, and 2.6.11 contained a vulnerability related to input validation errors. This vulnerability stemmed from modifying the PIDIDENTITYTOKEN or PIDPERMISSIONSTOKEN fields in the DATA sub-message,...

eProsima Fast DDS security vulnerabilities

eProsima Fast DDS is a C++ implementation of the OMG Object Management Group DDS Data Distribution Service standard by eProsima Corporation. Versions prior to 3.4.1, 3.3.1, and 2.6.11 of eProsima Fast DDS contained security vulnerabilities. These vulnerabilities were caused by modifying the...

Fast-DDS security vulnerabilities

Fast-DDS is a complete DDS system open-sourced by eProsima. Versions of Fast-DDS prior to 3.4.1, 3.3.1, and 2.6.11 contained security vulnerabilities. These vulnerabilities stemmed from modifying the PIDIDENTITYTOKEN or PIDPERMISSIONSTOKEN fields in the DATA sub-message, leading to integer...

Fast-DDS input validation vulnerability

Fast-DDS is a complete DDS system open-sourced by eProsima. Versions of Fast-DDS prior to 3.4.1, 3.3.1, and 2.6.11 contained a vulnerability related to input validation errors. This vulnerability stemmed from modifying the length of the PIDIDENTITYTOKEN or PIDPERMISSIONTOKEN fields in the DATA...

Apache Syncope code-related vulnerabilities

Apache Syncope is the United States Apache Apache Foundation's set of open source digital identity management system for use in enterprise environments. The system supports identity management, role configuration and more. Apache Syncope there is a code problem vulnerability , the vulnerability...

Improper Authentication And Authorization

github.com/openbao/openbao-plugins is vulnerable to Improper Authentication and Authorization. The vulnerability is due to insufficient validation of IAM role identity across AWS accounts, which allows an attacker from an untrusted account to impersonate a same-named role in a trusted account and...

SMCP: Secure Model Context Protocol

Agentic AI systems built around large language models LLMs are moving away from closed, single-model frameworks and toward open ecosystems that connect a variety of agents, external tools, and resources. The Model Context Protocol MCP has emerged as a standard to unify tool access, allowing agent...