Malicious code in test-mlw2-camas-built (npm)

The package test-mlw2-camas-built was found to contain malicious code...

What Security Should Look Like When Built for Developers

Security tools should support the way developers actually work. Here’s how we’re reimagining what that looks like...

CVE-2025-40761

A vulnerability has been identified in RUGGEDCOM ROX MX5000 All versions, RUGGEDCOM ROX MX5000RE All versions, RUGGEDCOM ROX RX1400 All versions, RUGGEDCOM ROX RX1500 All versions, RUGGEDCOM ROX RX1501 All versions, RUGGEDCOM ROX RX1510 All versions, RUGGEDCOM ROX RX1511 All versions, RUGGEDCOM R...

CVE-2025-40761

CVE-2025-40761 affects multiple Siemens RUGGEDCOM ROX devices (MX5000/MX5000RE, RX1400, RX1500/1501/1510/1511/1512/1524/1536, RX5000). The root cause is improper restriction of access through Built-In-Self-Test (BIST) mode, allowing a physically proximate attacker with serial access to bypass aut...

CVE-2025-40761: Authentication Bypass Using an Alternate Path or Channel

A vulnerability has been identified in RUGGEDCOM ROX MX5000 All versions, RUGGEDCOM ROX MX5000RE All versions, RUGGEDCOM ROX RX1400 All versions, RUGGEDCOM ROX RX1500 All versions, RUGGEDCOM ROX RX1501 All versions, RUGGEDCOM ROX RX1510 All versions, RUGGEDCOM ROX RX1511 All versions, RUGGEDCOM R...

PT-2025-32658

Name of the Vulnerable Software and Affected Versions: RUGGEDCOM ROX MX5000 affected versions not specified RUGGEDCOM ROX MX5000RE affected versions not specified RUGGEDCOM ROX RX1400 affected versions not specified RUGGEDCOM ROX RX1500 affected versions not specified RUGGEDCOM ROX RX1501 affecte...

Siemens RUGGEDCOM ROX II

SUMMARY RUGGEDCOM ROX II devices do not properly limit access through their Built-In-Self-Test BIST mode. This could allow a local attacker to bypass authentication and access a root shell on the device. Siemens is preparing fix versions and recommends specific countermeasures for products where...

Linux Distros Unpatched Vulnerability : CVE-2024-1556

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The incorrect object was checked for NULL in the built-in profiler, potentially leading to invalid memory access and undefined behavior. Note: This issue only...

BIT-LIBPYTHON-2024-8088 Infinite loop when iterating over zip archive entry names from zipfile.Path

There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive for example, methods of "zipfile.Path" like "namelist", "iterdir", etc...

Ghost CMS 5.42.1 - Path Traversal

!/usr/bin/env python3 -- coding: utf-8 -- """ Exploit Title: Ghost CMS 5.42.1 - Path Traversal Date: 2023-06-15 Exploit Author:ibrahimsql https://github.com/ibrahimsql Vendor Homepage: https://ghost.org Software Link: https://github.com/TryGhost/Ghost Version: =2.28.1 """ import requests import s...

SUSE CVE-2024-5321

A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated Users may be able to modify container logs...

TOTOLINK A702R Router Web Server DoS

The vulnerability of the built-in web server boa /boafrm/formPortFw of TOTOLINK A702R router’s microprogramming software is related to the issue of the operation exceeding the buffer in memory when processing the parameter servicetyp. Exploiting this vulnerability allows a malicious actor to caus...

Netgear RAX5 Router Arbitrary Command Execution

The vulnerability of the vifdisable function in the Netgear RAX5 router’s built-in software is related to the lack of measures for cleaning input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2025-4395

Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, which allows an attacker with physical access to log in with no password and access modify system functionality. This issue affects MyCareLink Patient Monitor models 24950 and 24952: before June 25, 2025...

CVE-2025-52952

An Out-of-bounds Write vulnerability in the connectivity fault management CFM daemon of Juniper Networks Junos OS on MX Series with MPC-BUILTIN, MPC1 through MPC9 line cards allows an unauthenticated adjacent attacker to send a malformed packet to the device, leading to an FPC crash and restart,...

Why browsing with Opera’s VPN is safer

Security Why browsing with Opera’s VPN is safer Share July 10th, 2025 A virtual private network VPN is a great way to protect yourself online, especially on public hotspots. Opera is the first major browser to have a built-in, no-log, unlimited browser VPN that is completely free. So how can you...

Logic Flaw Vulnerability in Firewall of Zhongke Shenwei Information Technology Co.

Ltd. is an enterprise specializing in network security technology research, network security products, independent controllable Xinchuang software and hardware products development, production, sales and service. Ltd. A logic flaw vulnerability exists in the CCTV firewall, which can be exploited ...

TOTOLINK X15 Router DoS

The vulnerability of the built-in boa server /boafrm/formSysLog of TOTOLINK X15 router microprogramming software is related to the issue where the operation data is written outside the buffer in memory when processing the submit-url parameter. Exploiting this vulnerability allows a malicious acto...

TOTOLINK EX1200T Routerboa Server Data Compromise

The vulnerability of the built-in boa server /boafrm/formNtp of the TOTOLINK EX1200T router’s microprogramming system is related to the issue of the operation going beyond the buffer in memory when processing the submit-url parameter. Exploiting this vulnerability allows a malicious actor to...

TOTOLINK EX1200T Router Built-in Server Boa XSS

The vulnerability of the built-in server boa /boafrm/formWirelessTbl of the TOTOLINK EX1200T router’s microprogramming software is related to the issue of the operation exceeding the buffer in memory when processing the submit-url parameter. Exploiting this vulnerability allows a malicious actor ...