CVE-2025-12106

Insufficient argument validation in OpenVPN 2.7alpha1 through 2.7rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses...

PT-2025-48441

Name of the Vulnerable Software and Affected Versions OpenVPN versions 2.7 alpha1 through 2.7 rc1 Description A flaw exists in OpenVPN due to inadequate argument validation. This issue allows an attacker to potentially cause a heap buffer over-read when processing IP addresses. Recommendations...

CVE-2025-64126

An OS command injection vulnerability exists due to improper input validation. The application accepts a parameter directly from user input without verifying it is a valid IP address or filtering potentially malicious characters. This could allow an unauthenticated attacker to inject arbitrary...

ThreatsDay Bulletin: AI Malware, Voice Bot Flaws, Crypto Laundering, IoT Attacks — and 20 More Stories

Hackers have been busy again this week. From fake voice calls and AI-powered malware to huge money-laundering busts and new scams, there's a lot happening in the cyber world. Criminals are getting creative — using smart tricks to steal data, sound real, and hide in plain sight. But they're not th...

CVE-2025-64126 Zenitel TCIV-3+ OS Command Injection

An OS command injection vulnerability exists due to improper input validation. The application accepts a parameter directly from user input without verifying it is a valid IP address or filtering potentially malicious characters. This could allow an unauthenticated attacker to inject arbitrary...

IBM Storage Virtualize IKEv1 Unauthorized Access

The vulnerability of the Internet Key Exchange IKEv1 protocol implementation in IBM Storage Virtualize software for virtualization of data storage systems is related to improper cleaning of dynamic memory. Exploiting this vulnerability allows a remote attacker to gain unauthorized access to...

Digital Twin-Driven Secure Access Strategy for SAGIN-Enabled IoT Networks

In space-air-ground integrated networks SAGIN-enabled IoT networks, secure access has become a significant challenge due to the increasing risks of eavesdropping attacks. To address these threats to data confidentiality, this paper proposes a Digital Twin DT-driven secure access strategy. The...

CLSA-2025-1764084458 bind: Fix of 2 CVEs

CVE-2025-40780: fix randomness sources, drop obsolete PRNG test - CVE-2025-40778: fix NS caching, DNAME/referral handling, restore IPv6 TCP tests...

kernel: cifs: fix oops during encryption

An out-of-bounds memory access vulnerability exists in the linux kernel, such that A stack-allocated buffer backed by vmalloc was passed into crypto code scatterwalkmapandcopy → memcpy where a cross-page write occurred. This ended up hitting a read-only mapping, causing a page-level fault and...

cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS

A flaw was found in the CUPS printing system’s ippreadio function, which handles Internet Printing Protocol IPP requests. When processing specially crafted printer attribute responses, improper validation can cause a null pointer dereference. This leads to a crash in libcups, potentially disrupti...

mDNS Service Public WAN (Internet) Accessible

The script checks if the target host is exposing a service supporting the Multicast DNS mDNS protocol to a Public WAN Internet. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

UFIDA U9 Multi-Organization Enterprise Internet Application Platform of UFIDA Network Technology Co.

UFIDA is a leading provider of management software, ERP software, group management software, human resource management software, customer relationship management software, small business management software, financial and administrative institution management software, automotive industry...

Ubuntu 16.04 LTS : Linux kernel (Oracle) vulnerabilities (USN-7875-1)

"The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7875-1 advisory. Jean-Claude Graf, Sandro Regge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel contained insufficient branch predictor isolation betwe...

CVE-2025-12039

The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 2.0.5 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for...

PT-2025-47807

Name of the Vulnerable Software and Affected Versions ESF-IDF versions 5.3.4 through 5.5.1 Description ESF-IDF, the Espressif Internet of Things IOT Development Framework, contains a flaw in its hardware JPEG decoder when used with the ESP32-P4. The software parser does not perform adequate...

CVE-2025-60738

An issue in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before Logic Version v6.00 - 20250721 and before allows a remote attacker to execute arbitrary code via the ping.php component does not perform secure filtering on IP parameters...

Vulnerabilities fixed in Arista EOS

Arista has fixed vulnerabilities in the Arista EOS platform. The vulnerabilities are related to the processing of malformed messages, which can lead to system crashes and denial-of-service conditions. High-privileged attackers can exploit these vulnerabilities, leading to severe operational...

PT-2025-47580

An issue in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before Logic Version v6.00 - 2025 07 21 and before allows a remote attacker to execute arbitrary code via the ping.php component does not perform secure filtering on IP parameters...

Ilevia EVE X1 Server security vulnerabilities

Ilevia EVE X1 Server is a smart home and building automation from Ilevia, Italy. A security vulnerability exists in Ilevia EVE X1 Server that stems from the ping.php component not securely filtering IP parameters, which could lead to the execution of arbitrary code...

Python-Based WhatsApp Worm Spreads Eternidade Stealer Across Brazilian Devices

Cybersecurity researchers have disclosed details of a new campaign that leverages a combination of social engineering and WhatsApp hijacking to distribute a Delphi-based banking trojan named Eternidade Stealer as part of attacks targeting users in Brazil. "It uses Internet Message Access Protocol...