Industrial Edge Device Kit Authentication Bypass

The vulnerability of the Industrial Edge Device Kit’s software for data collection, processing, and analysis is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to circumvent security restrictions remotely...

GHSA-5XM9-X7X4-4J5X Elasticsearch Vulnerable to Stack Overflow due to a Large Recursion

An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS through the handling of Well-Known Text formatted strings with nested GeometryCollection objects. An attacker can cause a stackoverflow by sending specially crafted requests that exploit this recursion. Details...

CVE-2024-52981

An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow...

Elasticsearch 7.17.24 and 8.15.1 Security Update (ESA-2024-37)

Elasticsearch Uncontrolled Resource Consumption vulnerability ESA-2024-37 An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow. Affected Versions: Elasticsearch versions 7.17....

Elastic Elasticsearch 资源管理错误漏洞

Elastic Elasticsearch is a search engine based on the Lucene library from the Dutch company Elastic. A resource management error vulnerability exists in Elastic Elasticsearch versions 7.17.0 through 7.17.23 and 8.0.0 through 8.15.0, which stems from a recursive issue when processing format string...

SUSE CVE-2025-21959

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconncount: Fully initialize struct nfconncounttuple in inserttree Since commit b36e4523d4d5 "netfilter: nfconncount: fix garbage collection confirm race", cpu and jiffies32 were introduced to the struct...

CVE-2025-30210

Bruno is an open source IDE for exploring and testing APIs. Prior to 1.39.1, the custom tool-tip components which internally use react-tooltip were setting the content in this case the Environment name as raw HTML which then gets injected into DOM on hover. This, combined with loose Content...

cpython3:fuzz_pycompile: Use-of-uninitialized-value in mark_stacks

Detailed Report: https://oss-fuzz.com/testcase?key=6139262328438784 Project: cpython3 Fuzzing Engine: libFuzzer Fuzz Target: fuzzpycompile Job Type: libfuzzermsancpython3 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: markstacks PyGCCollect PyHandlePending...

CVE-2025-30354

Bruno is an open source IDE for exploring and testing APIs. A bug in the assertion runtime caused assert expressions to run in Developer Mode, even if Safe Mode was selected. The bug resulted in the sandbox settings to be ignored for the particular case where a single request is run/sent. This...

CVE-2025-30210 Bruno XSS On Environment Name

Bruno is an open source IDE for exploring and testing APIs. Prior to 1.39.1, the custom tool-tip components which internally use react-tooltip were setting the content in this case the Environment name as raw HTML which then gets injected into DOM on hover. This, combined with loose Content...

PT-2025-14115

Name of the Vulnerable Software and Affected Versions Bruno versions prior to 1.39.1 Description The issue arises from custom tool-tip components using react-tooltip, which set content as raw HTML and inject it into the DOM on hover. This, combined with loose Content Security Policy restrictions,...

DEBIAN-CVE-2025-21893

In the Linux kernel, the following vulnerability has been resolved: keys: Fix UAF in keyput Once a key's reference count has been reduced to 0, the garbage collector thread may destroy it at any time and so keyput is not allowed to touch the key after that point. The most keyput is normally allow...

CVE-2025-21893

In the Linux kernel, the following vulnerability has been resolved: keys: Fix UAF in keyput Once a key's reference count has been reduced to 0, the garbage collector thread may destroy it at any time and so keyput is not allowed to touch the key after that point. The most keyput is normally allow...

CVE-2025-28090

maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery SSRF in the Collection Custom Interface feature...

CVE-2025-28090

maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery SSRF in the Collection Custom Interface feature...

Malicious code in f0-data-collection-service-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd259047f778caae5a62f90a3e65d036275f868a44c49abb25887167bbfdda91 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2759 Malicious code in f0-data-collection-service-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd259047f778caae5a62f90a3e65d036275f868a44c49abb25887167bbfdda91 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in f0-data-collection-service-mock

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

SUSE CVE-2022-49738

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on iextraisize in isalive syzbot found a f2fs bug: BUG: KASAN: slab-out-of-bounds in datablkaddr fs/f2fs/f2fs.h:2891 inline BUG: KASAN: slab-out-of-bounds in isalive fs/f2fs/gc.c:1117 inline BUG: KASA...