PT-2025-32058 · Kenwood · Kenwood Dmx958Xr

Name of the Vulnerable Software and Affected Versions: Kenwood DMX958XR affected versions not specified Description: This issue allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices without authentication. The flaw resides within the...

CVE-2025-27212

An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management network. Affected Products: UniFi Access Reader Pro Version 2.14.21 and earlier UniFi Access G2 Reader Pro Version 1.10.32 and earlier UniFi...

CVE-2025-38416

Mode C: CVE-2025-38416 affects the Linux kernel NFC: nci: uart path. The vulnerability arises from setting tty->disc_data before the NCI device open/driver request succeeds, creating a small window where the device may start sending data and leaving state inconsistent on error paths. The fix e...

CVE-2025-7705

: Active Debug Code vulnerability in ABB Switch Actuator 4 DU-83330, ABB Switch actuator, door/light 4 DU -83330-500.This issue affects Switch Actuator 4 DU-83330: All Versions; Switch actuator, door/light 4 DU -83330-500: All Versions...

CVE-2025-49831 Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) vulnerable to IAM Authenticator Bypass via Mis-configured Network Device

An attacker of Secrets Manager, Self-Hosted installations that route traffic from Secrets Manager to AWS through a misconfigured network device can reroute authentication requests to a malicious server under the attacker’s control. CyberArk believes there to be very few installations where this...

CVE-2025-49831

CVE-2025-49831 affects CyberArk Secrets Manager Self-Hosted and Conjur OSS, with a bypass of IAM authenticator possible when traffic from Secrets Manager to AWS is routed through a misconfigured network device. Affected versions include Secrets Manager Self-Hosted before 13.5.1/13.6.1 and Conjur ...

Belkin F9K1122 Command Injection Vulnerability (CNVD-2025-20834)

The Belkin F9K1122 is a WiFi signal extender from Belkin Canada. The Belkin F9K1122 suffers from a command injection vulnerability that originates from a misbehavior of the parameters mwanipaddr/mwannetmask/mwangateway/mwanstaticdns1/mwanstaticdns2 in the file /goform/formSetWanStatic. can be...

CVE-2025-49604

For Realtek AmebaD devices, a heap-based buffer overflow was discovered in Ameba-AIoT ameba-arduino-d before version 3.1.9 and ameba-rtos-d before commit c2bfd8216a1cbc19ad2ab5f48f372ecea756d67a on 2025/07/03. In the WLAN driver defragment function, lack of validation of the size of fragmented...

CVE-2025-40742

A vulnerability has been identified in SIPROTEC 5 6MD84 CP300 All versions V11.0, SIPROTEC 5 6MD85 CP200 All versions, SIPROTEC 5 6MD85 CP300 All versions V11.0, SIPROTEC 5 6MD86 CP200 All versions, SIPROTEC 5 6MD86 CP300 All versions V11.0, SIPROTEC 5 6MD89 CP300 All versions V11.0, SIPROTEC 5...

PT-2025-28071 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A reference leak issue has been identified in the Linux kernel, specifically in the HID appletb-kbd module. The problem occurs when the appletb kbd probe function attempts to get the...

CVE-2025-34055 AVTECH IP camera, DVR, and NVR Devices Authenticated Root Command Execution

An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint, which interfaces with the ActionD daemon. Authenticated users can invoke the DoShellCmd operation, passing arbitrary input via the strCmd parameter. This input is executed...

CVE-2025-34050 AVTECH IP Camera, DVR, and NVR Devices Cross-Site Request Forgery

A cross-site request forgery CSRF vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user’s browser session, allow unauthorized changes to the device configuration...

Vulnerability of the magicmouse_probe() function in the drivers/hid/hid-magicmouse.c module – This driver of the input device subsystem in the Linux operating system allows a hacker to cause a service failure.

Vulnerability of the magicmouseprobe function in the drivers/hid/hid-magicmouse.c module – The driver for the Linux kernel’s input device subsystem is vulnerable due to a pointer issue related to NULL pointers. Exploiting this vulnerability could allow an attacker to cause system failures...

The vulnerability of the usb6fire_chip_abort() function in the sound/usb/6fire/chip.c module allows a hacker to trigger a service failure for USB audio devices in Linux operating systems.

The vulnerability of the usb6firechipabort function in the sound/usb/6fire/chip.c module, which supports USB audio devices in Linux operating systems, is related to the reutilization of previously freed memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2022-49983

The issue CVE-2022-49983 affects the Linux kernel udmabuf driver. If the udmabuf DMA mask is not set explicitly, userspace DMA-BUF access via the CPU can trigger a warning in dma_map_sg_attrs (kernel/dma/mapping.c) during dma-buf CPU access flows (as shown in the stack trace). The vulnerability i...

CVE-2025-38044 media: cx231xx: set device_caps for 417

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: set devicecaps for 417 The videodevice for the MPEG encoder did not set devicecaps. Add this, otherwise the video device can't be registered you get a WARNON instead. Not seen before since currently 417 support is...

CVE-2024-35295

A vulnerability has been identified in Perfect Harmony GH180 All versions = V8.0 V8.3.3 with NXGPro+ controller manufactured between April 2020 to April 2025. The maintenance connection of affected devices fails to protect access to the device's control unit configuration. This could allow an...

Pioneer DMH-WT7600NEX Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to bypass authentication on affected installations of Pioneer DMH-WT7600NEX devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the configuratio...

Pioneer DMH-WT7600NEX Software Update Signing Insufficient Verification of Data Authenticity Vulnerability

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Pioneer DMH-WT7600NEX devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the software update verification process. The issue results fr...

TOTOLINK X2000R devicemac1 Command Injection Vulnerability

TOTOLINK X2000R is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK X2000R suffers from a command injection vulnerability that stems from incorrect manipulation of the parameter devicemac1, no details of the vulnerability are provided at this time...