Is Your Prompt Poisoning Code? Defect Induction Rates and Security Mitigation Strategies

Large language models LLMs have become indispensable for automated code generation, yet the quality and security of their outputs remain a critical concern. Existing studies predominantly concentrate on adversarial attacks or inherent flaws within the models. However, a more prevalent yet...

K000157114: cPython vulnerability CVE-2025-4517

Security Advisory Description Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall or TarFile.extract using the filter...

Access Control Bypass

Overview @kottster/common is a Common types and utilities for Kottster Affected versions of this package are vulnerable to Access Control Bypass via the initApp and installPackagesForDataSource actions. An attacker can gain unauthorized administrative access and execute arbitrary system commands ...

CVE-2025-10705

creationtimestamp| type| source ---|---|--- 2025-10-23 14:51:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m3umda5j2n2u...

Vulnerabilities fixed in Oracle Commerce

Oracle has fixed vulnerabilities in several subcomponents of Oracle Commerce products, including Oracle Middleware Common Libraries, Oracle Documaker, Oracle WebCenter Forms Recognition, Oracle WebLogic Server, and Oracle Application Testing Suite. The vulnerabilities allow unauthenticated...

CVE-2025-60341

creationtimestamp| type| source ---|---|--- 2025-10-22 17:51:08+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115419084710628503 2025-10-22 21:11:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m3sr2vqqlb2c...

CVE-2023-53728

In the Linux kernel, the following vulnerability has been resolved: posix-timers: Ensure timer ID search-loop limit is valid posixtimeradd tries to allocate a posix timer ID by starting from the cached ID which was stored by the last successful allocation. This is done in a loop searching the ID...

DEBIAN-CVE-2023-53719

In the Linux kernel, the following vulnerability has been resolved: serial: arcuart: fix ofiomap leak in arcserialprobe Smatch reports: drivers/tty/serial/arcuart.c:631 arcserialprobe warn: 'port-membase' from ofiomap not released on lines: 631. In arcserialprobe, if uartaddoneport fails,...

CVE-2025-11866

creationtimestamp| type| source ---|---|--- 2025-10-22 08:43:34+00:00| seen| Telegram/EX2LHB4HrGv-ZI8Q0F0bprYlpRim0c5v8ijnOC8FxHvGFg0...

SUSE CVE-2025-54764

Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtlsmpimodinv or mbedtlsmpigcd...

Use of Hard-coded Cryptographic Key

Overview Affected versions of this package are vulnerable to Use of Hard-coded Cryptographic Key for encrypting sensitive configurations when NeuVector stores data. The static key can be used to retrieve configuration data. Remediation Upgrade github.com/neuvector/neuvector/controller/common to...

CVE-2025-62587

...

CVE-2025-62287

CVE-2025-62287 affects Oracle Life Sciences InForm (Web Server) in Oracle Health Sciences Applications, affected version 7.0.1.0. The vulnerability allows unauthenticated network access via HTTP to compromise InForm, with attacks requiring user interaction from a non-attacker. Impact may include ...

CVE-2025-61754

...

CVE-2025-53061

The CVE-2025-53061 entry concerns Oracle PeopleSoft’s PeopleTools (PIA Core Technology) with affected versions 8.60, 8.61 and 8.62. Documents consistently describe an easily exploitable vulnerability that allows a high-privilege attacker, over HTTP with network access, to perform unauthorized upd...

CVE-2025-53059

CVE-2025-53059 affects Oracle PeopleSoft: PeopleSoft Enterprise PeopleTools (OpenSearch Dashboards) with affected versions 8.60, 8.61, 8.62. The flaw enables a high-privileged attacker with network access via HTTP to compromise PeopleSoft PeopleTools and potentially obtain unauthorized access to ...

CVE-2025-53046

...

`tokio-tar` parses PAX extended headers incorrectly, allows file smuggling

The archive reader incorrectly handles PAX extended headers, when the ustar header incorrectly specifies zero size size=000000000000, while a PAX header specifies a non-zero size, tokio-tar::Archive is going to read the file content as tar entry header. This can be used by a tar file to present...

CVE-2025-7851

creationtimestamp| type| source ---|---|--- 2025-10-21 01:46:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m3o7jd6gzz2o 2025-10-21 13:19:14+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115412353242186528 2025-10-23 11:33:46+00:00| seen|...

CVE-2025-54764

Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtlsmpimodinv or mbedtlsmpigcd. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ea...