EUVD-2025-19738

Malicious code in bioql PyPI...

EUVD-2021-7025

Malicious code in bioql PyPI...

Kicking off Cybersecurity Awareness Month 2025: Researcher spotlights and enhanced incentives

October marks Cybersecurity Awareness Month, a time when the developer community reflect on the importance of security in the evolving digital landscape. At GitHub, we understand that protecting the global software ecosystem relies on the commitment, skill, and ingenuity of the security research...

CVE-2025-54081

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager SCM interprets the path...

CVE-2025-54081

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager SCM interprets the path...

OMRON SOCIAL SOLUTIONS Uninterruptible Power Supply (UPS) management application registers a Windows service with an unquoted file path

Overview Uninterruptible Power Supply UPS management application provided by OMRON SOCIAL SOLUTIONS Co., Ltd. registers a Windows service with an unquoted file path CWE-428, CVE-2025-9818. OMRON SOCIAL SOLUTIONS Co., Ltd. reported this vulnerability to JPCERT/CC to notify users of its solution...

CVE-2025-9818

A vulnerability CWE-428 has been identified in the Uninterruptible Power Supply UPS management application provided by OMRON SOCIAL SOLUTIONS Co., Ltd., where the executable file paths of Windows services are not enclosed in quotation marks. If the installation folder path of this product contain...

CVE-2025-9818

A vulnerability CWE-428 has been identified in the Uninterruptible Power Supply UPS management application provided by OMRON SOCIAL SOLUTIONS Co., Ltd., where the executable file paths of Windows services are not enclosed in quotation marks. If the installation folder path of this product contain...

CVE-2025-9818 Vulnerability caused by unquoted file paths of Windows services registered by the Uninterruptible Power Supply (UPS) management application

A vulnerability CWE-428 has been identified in the Uninterruptible Power Supply UPS management application provided by OMRON SOCIAL SOLUTIONS Co., Ltd., where the executable file paths of Windows services are not enclosed in quotation marks. If the installation folder path of this product contain...

CVE-2025-9818

CVE-2025-9818 describes a CWE-428 issue in the UPS management application from OMRON SOCIAL SOLUTIONS Co., Ltd. where Windows service executable paths are not quoted, enabling potential unauthorized file execution with service privileges if the install path contains spaces. Supported by multiple ...

CVE-2025-9818 Vulnerability caused by unquoted file paths of Windows services registered by the Uninterruptible Power Supply (UPS) management application

A vulnerability CWE-428 has been identified in the Uninterruptible Power Supply UPS management application provided by OMRON SOCIAL SOLUTIONS Co., Ltd., where the executable file paths of Windows services are not enclosed in quotation marks. If the installation folder path of this product contain...

PT-2025-38109

Name of the Vulnerable Software and Affected Versions: OMRON SOCIAL SOLUTIONS Co., Ltd. UPS management application affected versions not specified Description: The Uninterruptible Power Supply UPS management application is susceptible to a flaw where executable file paths for Windows services are...

Important: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.23.0 Release.

Red Hat OpenShift Dev Spaces 3.23.0 has been released. Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development. The 3.23 release is based on...

Kibana 9.0.x < 9.0.6 / 9.1.x < 9.1.3 Incorrect Authorization (ESA-2025-13)

The version of Kibana running on the remote host is prior to 9.0 prior to 9.0.6 or 9.1 prior to 9.1.3. It is, therefore, a vulnerability as referenced in the ESA-2025-13 advisory. - Incorrect authorization in Kibana can lead to privilege escalation via the built-in reportinguser role which...

Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go

...

The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.

...

The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.

...

Missing Authorization

Mattermost Confluence Plugin is vulnerable to Missing Authorization. The vulnerability is due to missing authorization checks due to failure to validate user access to Confluence spaces before allowing subscription creation via the create subscription endpoint...

BIT-KIBANA-2025-25010 Kibana privilege escalation via reporting_user role

Incorrect authorization in Kibana can lead to privilege escalation via the built-in reportinguser role which incorrectly has the ability to access all Kibana Spaces...

BIT-ELK-2025-25010 Kibana privilege escalation via reporting_user role

Incorrect authorization in Kibana can lead to privilege escalation via the built-in reportinguser role which incorrectly has the ability to access all Kibana Spaces...