Security Bulletin: NVIDIA Isaac Lab - December 2025

NVIDIA has released an update for the NVIDIA Isaac™ Lab component of NVIDIA Isaac Sim™ framework to address a security issue that might lead to the impacts described in this bulletin. To protect your system, download and install the latest version of Isaac Lab. Go to NVIDIA Product Security...

GO-2025-4218 memos lacks file name validation or verification in github.com/usememos/memos

memos lacks file name validation or verification in github.com/usememos/memos...

CVE-2025-40200 affecting package kernel for versions less than 6.6.117.1-1

CVE-2025-40200 affecting package kernel for versions less than 6.6.117.1-1. An upgraded version of the package is available that resolves this issue...

PT-2025-51196

Student Learning Assessment and Support System developed by JHENG GAO has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to view a specific page and obtain test accounts and password...

CVE-2025-14129

creationtimestamp| type| source ---|---|--- 2025-12-12 08:30:04+00:00| seen| https://gist.github.com/Darkcrai86/644de7a7cdb489b9622d3e16c420b5e9...

EUVD-2025-202768

Servify Express is a Node.js package to start an Express server and log the port it's running on. Prior to 1.2, the Express server used express.json without a size limit, which could allow attackers to send extremely large request bodies. This can cause excessive memory usage, degraded performanc...

EUVD-2025-203043

Malicious code in sdbao-content-report npm...

WordPress plugin Blaze Demo Importer 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

EUVD-2024-55321

Authentication Bypass by Spoofing vulnerability in HYPR Server allows Identity Spoofing.This issue affects Server: before 10.1...

CVE-2025-12562

creationtimestamp| type| source ---|---|--- 2025-12-11 15:25:32+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3m7pv2q3ouq2z...

CVE-2025-11984

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to bypass WebAuthn two-factor authentication by manipulating the session state under certain conditions...

CVE-2025-8405

Removed by vendor...

CVE-2025-12562

Removed by vendor...

CVE-2023-53829

A kernel panic vulnerability was found in the F2FS filesystem in the Linux kernel. When an atomic file operation is aborted, the inode is not properly flushed, leaving it in a dirty state during eviction. This triggers f2fsbugon in f2fsevictinode when the FIDIRTYINODE flag is still set, causing a...

DEBIAN-CVE-2025-59030

An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP...

CVE-2023-53844

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Don't leak a resource on swapout move error If moving the bo to system for swapout failed, we were leaking a resource. Fix...

CVE-2025-63059 WordPress Ninja Popups plugin <= 4.7.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in arscode Ninja Popups arscode-ninja-popups allows Stored XSS.This issue affects Ninja Popups: from n/a through = 4.7.8...

EUVD-2025-201909

Malicious code in jsonify-errors npm...

CVE-2023-53802

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: htchst: free skb in ath9khtcrxmsg if there is no callback function It is stated that ath9khtcrxmsg either frees the provided skb or passes its management to another callback function. However, the skb is not freed in...

Mozilla Firefox 缓冲区错误漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A buffer error vulnerability exists in versions prior to Mozilla Firefox 146, which stems from a memory security issue that could lead to memory corruption and execution of arbitrary code...