PT-2025-12339 · D Link · D-Link Dir-605L +1

Name of the Vulnerable Software and Affected Versions: D-Link DIR-618 versions 2.02/3.02 D-Link DIR-605L versions 2.02/3.02 Description: A problematic issue has been found, affecting some unknown processing of the file /goform/formAdvNetwork, leading to improper access controls. The attack can on...

GHSA-X3M8-F7G5-QHM7 vLLM Allows Remote Code Execution via Mooncake Integration

Summary When vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP will allow attackers to execute remote code on distributed hosts. Details 1. Pickle deserialization vulnerabilities are well documented. 2. The mooncake pipe is exposed over the network by design...

CVE-2025-30139

An issue was discovered on G-Net Dashcam BB GONX devices. Default credentials for SSID cannot be changed. It broadcasts a fixed SSID with default credentials that cannot be changed. This allows any nearby attacker to connect to the dashcam's network without restriction. Once connected, an attacke...

CVE-2025-2350 IROAD Dash Cam FX2 upload_file unrestricted upload

A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been rated as critical. Affected by this issue is some unknown functionality of the file /action/uploadfile. The manipulation leads to unrestricted upload. Access to the local network is required for this attack to succeed. Th...

CVE-2025-2347 IROAD Dash Cam FX2 Device Registration default password

A vulnerability was found in IROAD Dash Cam FX2 up to 20250308 and classified as problematic. This issue affects some unknown processing of the component Device Registration. The manipulation of the argument Password with the input qwertyuiop leads to use of default password. The attack needs to ...

CVE-2025-2347 IROAD Dash Cam FX2 Device Registration default password

A vulnerability was found in IROAD Dash Cam FX2 up to 20250308 and classified as problematic. This issue affects some unknown processing of the component Device Registration. The manipulation of the argument Password with the input qwertyuiop leads to use of default password. The attack needs to ...

CVE-2025-24986

Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network...

CVE-2025-24051

Heap-based buffer overflow in Windows Routing and Remote Access Service RRAS allows an unauthorized attacker to execute code over a network...

CVE-2025-24056

Heap-based buffer overflow in Windows Telephony Server allows an unauthorized attacker to execute code over a network...

CVE-2025-21247

CVE-2025-21247 is a MapUrlToZone security bypass in Windows. Description: Improper resolution of path equivalence allows a network attacker to bypass a security feature. CVSS: 3.1, Network attack, Low complexity, No privileges required, User interaction required, Confidentiality impact Low; Integ...

CVE-2025-24986

Azure PromptFlow components are affected by CVE-2025-24986: promptflow-core < 1.17.2 and promptflow-tools

CVE-2025-26634

CVE-2025-26634 describes a heap-based buffer overflow in Windows Core Messaging that could allow an unauthenticated? not; authorized attacker to elevate privileges over a network. The CVE entry lists a CVSS v3.1 base score of 7.5 (HIGH) with NETWORK attack vector, HIGH impact on confidentiality/i...

Windows Core Messaging Elevation of Privileges Vulnerability

Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges over a network...

CVE-2022-49372 tcp: tcp_rtx_synack() can be called from process context

In the Linux kernel, the following vulnerability has been resolved: tcp: tcprtxsynack can be called from process context Laurent reported the enclosed report 1 This bug triggers with following coditions: 0 Kernel built with CONFIGDEBUGPREEMPT=y 1 A new passive FastOpen TCP socket is created. This...

CVE-2022-49333 net/mlx5: E-Switch, pair only capable devices

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch, pair only capable devices OFFLOADS paring using devcom is possible only on devices that support LAG. Filter based on lag capabilities. This fixes an issue where mlx5getnextphysdev was called without holding th...

CVE-2025-25891

A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01, triggered by the destination, netmask and gateway parameters. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted packet...

CVE-2025-1006

Use after free in Network in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted web app. Chromium security severity: Medium...

CVE-2025-25896

A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01 via the destination, netmask, and gateway parameters. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted packet...

CVE-2025-23406

Out-of-bounds read vulnerability caused by improper checking of TCP MSS option values exists in Cente middleware TCP/IP Network Series, which may lead to processing a specially crafted packet to cause the affected product crashed...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2024-50199: mm/swapfile: skip HugeTLB pages for unusevma bsc1233112. CVE-2024-53104: media: uvcvideo: Skip parsing frames of type UVCVSUNDEFINED in uvcparseform...