The vulnerability of AMD’s microprogramming software for processors lies in the insufficient protection of operational data, which allows attackers to disclose protected information.

The vulnerability of AMD’s microprogramming software is related to insufficient protection of operational data. Exploiting this vulnerability can allow attackers to disclose protected information...

CVE-2025-7382

A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 21.0.2 can lead to adjacent attackers achieving pre-auth code execution on High Availability HA auxiliary devices, if OTP authentication for the admin user is enabled...

Google Sues the Badbox Botnet Operators

It will be interesting to watch what will come of this private lawsuit: Google on Thursday announced filing a lawsuit against the operators of the Badbox 2.0 botnet, which has ensnared more than 10 million devices running Android open source software. These devices lack Google's security...

CVE-2025-41684 Weidmueller: Root Command Injection via Unsanitized Input in tls_iotgen_setting Endpoint

An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in the Main Web Interface endpoint tlsiotgensetting...

CVE-2025-7766 Lantronix Provisioning Manager Improper Restriction of XML External Entity Reference

Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed...

USN-7654-4 linux-kvm vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - PA-RISC architecture; - PowerPC architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; -...

Malicious code in cloudmedia (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62e6d2716738fc8638adab6e75520d92c5b3a3f4cccdd5ada061be73131571cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nodemail-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1a1a416c6d186e11b3cc31cc998939044fa947ec048748fa3542568d609fc485 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in internallib_v866 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb97247ec65fbb71cecbd98a2b0c9970569f51fb2c2af8efb1f2bb619cd4483e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in internal-plugin-telemetry-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1d9d94ab30d6ec88b722127b9f7fcd84c80e7e5bc2fda3c7865104dea4a0fcc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kiwi-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0dcbebb4e37e86a0a7878eafb520d0acd1ad5d8a97aabcce547b807bddec6cef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in simple-line-icons-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5bf593593545cc9181f1cc4b8f5832bc438fe436a6181cc341cc59645a558c4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mozilla-l10n-docs-linter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d878786926dde4c1aa2b65c2241ee43a14fbd2a46d890e608e4374ef405ff359 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-7945 D-Link DIR-513 formSetWanDhcpplus buffer overflow

A vulnerability was found in D-Link DIR-513 up to 20190831. It has been declared as critical. This vulnerability affects the function formSetWanDhcpplus of the file /goform/formSetWanDhcpplus. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely...

CVE-2025-46123

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where the authenticated configuration endpoint /admin/conf.jsp writes the Wi-Fi guest password to memory with snprintf using the attacker-supplied...

CVE-2025-7382

A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 21.0.2 can lead to adjacent attackers achieving pre-auth code execution on High Availability HA auxiliary devices, if OTP authentication for the admin user is enabled...

PT-2025-30259 · Unknown · Two App Studio Journey

Name of the Vulnerable Software and Affected Versions: Two App Studio Journey version 5.5.9 Description: The application stores data in an unencrypted format within its database on iOS devices. This allows local attackers to extract sensitive information by directly accessing the application’s...

CVE-2025-44655

In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chrootlocaluser option is enabled in the vsftpd.conf. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal network attacks...

Moderate: fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fixes: setuptools: Path Traversal Vulnerability in setuptools PackageIndex...

ALSA-2025:11463 Moderate: fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fixes: setuptools: Path Traversal Vulnerability in setuptools PackageIndex...