EUVD-2025-175313

A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614B20230630 within the cloudupdatecheck binary, specifically in the sub402414 function that handles cloud update parameters. User-supplied 'magicid' and 'url' values are directly concatenated into shell...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.19 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.19 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.19 security, enhancement & bug fix update...

Cisco Catalyst Center Virtual Appliance HTTP Open Redirect Vulnerability

A vulnerability in the web-based management interface of Cisco Catalyst Center Virtual Appliance could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of HTTP request parameters. An attacker could exploit...

Cisco Catalyst Center Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Catalyst Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface of an affected device. This vulnerability is due to insufficient validation of user input. An...

Cisco Catalyst Center Virtual Appliance Privilege Escalation Vulnerability

A vulnerability in Cisco Catalyst Center Virtual Appliance could allow an authenticated, remote attacker to elevate privileges to Administrator on an affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by...

CVE-2025-64529

A vulnerability has been identified in the WriteRelationships API of SpiceDB, where large relationship-update requests can be silently dropped when the payload exceeds what the underlying datastore permits. This occurs because the server does not always return an error when processing oversized...

MAL-2025-190338 Malicious code in winston-pino-jasmine-jupiter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5379730ea03719315dac34057961525d8cb45f557c9a2a4ad60fa9929dadfc6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Mageia: Security Advisory (MGASA-2025-0281)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-a35addbf9b)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-12817

Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before...

Intel® Xeon Processor Advisory

Summary: A potential security vulnerability in some Intel® Xeon Processors may allow denial of service. Intel is releasing firmware updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2024-22374 Description: Insufficient control flow management for some Intel® Xeon...

CVE-2025-12818

Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions...

Fedora: Security Advisory (FEDORA-2025-b6e0f437b6)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 42 : docker-buildkit (2025-ac008831d6)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-ac008831d6 advisory. - Update to v0.25.2 - CVE-2025-58183; Resolves: rhbz2412529 - CVE-2025-58188; Resolves: rhbz2412380, rhbz2411476, rhbz2410945 - CVE-2025-58185;...

CVE-2025-12940

Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610 and WAX610Y AX1800 Dual Band PoE Multi-Gig Insight Managed WiFi 6 Access Points. An user having access to the syslog server can read the logs containing these credentials. This issue affects...

Malicious code in ilang-47 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8af1a4cf1d638904160508a864179206bed5ea5e71adceb717a93d3cc26e4d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lookingan-namalaka67 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd806b67baebd1cfd6aa40fb643606cdc0dd1d11fb42a85be9e10f5a0404d108 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-158825 Malicious code in lookingan-namalaka16 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80cc28a06b269761a3b23d2be8f0ef1fc5d52e59bd9f4c6a35f5ee1f13648672 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-150845 Malicious code in @miptaa02/mqhg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ca38583daa1baf5164468b9b342771b047ad6f71ce8c352053412de8d931fbf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-163728 Malicious code in nudela-afif-gafai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dd02ae622dd3c7c1c110ffa7683444a08ee759876579f127162dc2c572f4472 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...