LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer

Summary Prior to langgraph-checkpoint version 3.0 , LangGraph’s JsonPlusSerializer used as the default serialization protocol for all checkpointing contains a remote code execution RCE vulnerability when deserializing payloads saved in the "json" serialization mode. If an attacker can cause your...

CVE-2025-57107

Kitware VTK Visualization Toolkit contains a heap buffer overflow vulnerability in vtkGLTFDocumentLoader. When processing specially crafted GLTF files, the copy constructor of Accessor objects fails to properly validate buffer boundaries before performing memory read operations...

CVE-2025-57107

Kitware VTK (Visualization Toolkit) versions up to and including 9.5.0 contain a heap buffer overflow in vtkGLTFDocumentLoader. The root cause is the copy constructor of Accessor objects not properly validating buffer boundaries when processing specially crafted GLTF files, leading to out-of-boun...

CVE-2025-57107

Kitware VTK Visualization Toolkit through 9.5.0 contains a heap buffer overflow vulnerability in vtkGLTFDocumentLoader. When processing specially crafted GLTF files, the copy constructor of Accessor objects fails to properly validate buffer boundaries before performing memory read operations...

Kitware VTK 安全漏洞

Kitware VTK is a 3D image generation software from Kitware open source. A security vulnerability exists in Kitware VTK 9.5.0 and earlier versions, which stems from a heap buffer overflow that can be caused by the copy constructor of the Accessor object not properly validating buffer boundaries wh...

WordPress Constructor plugin permission issue vulnerability

WordPress Constructor plugin is a framework for simplifying plugin development, mainly used to help developers quickly build and manage the plugin's components such as options pages, forms and custom fields. WordPress Constructor plugin suffers from a privilege issue vulnerability that stems from...

CVE-2025-9194

The Constructor theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clean function in all versions up to, and including, 1.6.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger a them...

EUVD-2012-3817

Malware in sbrugna...

EUVD-2012-3815

Malware in sbrugna...

EUVD-2019-0712

Malware in sbrugna...

EUVD-2006-4360

Malware in sbrugna...

EUVD-2021-1518

Malware in sbrugna...

EUVD-2018-0073

Malware in sbrugna...

EUVD-2012-3814

Malware in sbrugna...

EUVD-2007-0800

Malware in sbrugna...

EUVD-2018-0370

Malware in sbrugna...

EUVD-2012-3816

Malware in sbrugna...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986387)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986387 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential hang in nilfsdetachlogwriter Syzbot has reported a potential hang in...

EUVD-2025-24803

Flowise vulnerable to RCE via Dynamic function constructor injection...

Flowise vulnerable to RCE via Dynamic function constructor injection

Summary User-controlled input flows to an unsafe implementaion of a dynamic Function constructor , allowing a malicious actor to run JS code in the context of the host not sandboxed leading to RCE. Details When creating a new Custom MCP Chatflow in the platform, the MCP Server Config displays a...