EUVD-2025-36515

IPFire versions prior to 2.29 Core Update 198 contain a stored cross-site scripting XSS vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the TLSHOSTNAME parameter when adding a new DNS entry. When a user adds a DNS entry, the application issues an HT...

Around 70 countries sign new UN Cybercrime Convention—but not everyone’s on board

Around 70 countries have signed the new United Nations UN Convention against Cybercrime—the first global treaty designed to combat cybercrime through unified international rules and cooperation. The treaty needs at least 40 UN member states to ratify it before it becomes international law. Once t...

DEBIAN-CVE-2025-40064

In the Linux kernel, the following vulnerability has been resolved: smc: Fix use-after-free in pnetfindbasendev. syzbot reported use-after-free of netdevice in pnetfindbasendev, which was called during connect. 0 smcpnetfindismresource fetches skdstgetsk-dev and passes down to pnetfindbasendev,...

PT-2025-48275

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.5.x through 10.5.12 Mattermost versions 10.11.x through 10.11.4 Mattermost versions 10.12.x through 10.12.1 Mattermost versions 11.0.x through 11.0.2 Description The software does not properly restrict access to team ema...

ROS-20251028-01

A vulnerability in the Webmin hosting control panel CGI request handler is associated with errors in processing input data. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code with root privileges...

Fedora: Security Advisory (FEDORA-2025-b93734b6b8)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-cf4f628312)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-55752

creationtimestamp| type| source ---|---|--- 2025-10-27 17:51:36+00:00| seen| https://seclists.org/oss-sec/2025/q4/75 2025-10-27 19:11:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m474q3zn6m23 2025-10-27 19:28:14+00:00| seen|...

CVE-2025-54970

creationtimestamp| type| source ---|---|--- 2025-10-27 17:05:53+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115447218372328793 2025-10-27 19:15:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m474wsx5bv2p...

Security update for cmake

This update for cmake fixes the following issues: CVE-2025-9301: Fixed assertion failure due to improper validation bsc1248461 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the...

Identity Spoofing

org.igniterealtime.openfire, xmppserver is vulnerable to identity spoofing. The vulnerability is due to regex-based extraction of the Common Name CN from an unescaped, provider-dependent Distinguished Name DN string, which allows an attacker to impersonate other users using crafted certificate...

CVE-2025-12209

creationtimestamp| type| source ---|---|--- 2025-10-27 04:36:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m45lte6z4e2u...

CVE-2025-12210

creationtimestamp| type| source ---|---|--- 2025-10-27 04:31:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m45lkfr2io2o...

EUVD-2025-36081

Malicious code in legacyesgodfcommon npm...

MAL-2025-48735 Malicious code in legacy_esg_odf_common (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c56f634d22583d4f5aa8a52eeab8e3d5c0659c0cbfd1a5a9b0a4741b02ca251d Any computer that has this package installed or running should be considered...

Malicious code in gear-bridge-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 74e84b9a555df93618c5127eddd0b90f79c79e8b54a5c60a0deb241487f867d7 The OpenSSF Package Analysis project identified 'gear-bridge-common' @ 1337.1.0 npm as malicious. It is considered malicious because: - The...

MAL-2025-48607 Malicious code in gear-bridge-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 74e84b9a555df93618c5127eddd0b90f79c79e8b54a5c60a0deb241487f867d7 The OpenSSF Package Analysis project identified 'gear-bridge-common' @ 1337.1.0 npm as malicious. It is considered malicious because: - The...

EUVD-2025-35948

Malicious code in gear-bridge-common npm...

Is Your Prompt Poisoning Code? Defect Induction Rates and Security Mitigation Strategies

Large language models LLMs have become indispensable for automated code generation, yet the quality and security of their outputs remain a critical concern. Existing studies predominantly concentrate on adversarial attacks or inherent flaws within the models. However, a more prevalent yet...

K000157114: cPython vulnerability CVE-2025-4517

Security Advisory Description Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall or TarFile.extract using the filter...