UBUNTU-CVE-2025-50681

igmpproxy 0.4 before commit 2b30c36 allows remote attackers to cause a denial of service application crash via a crafted IGMPv3 membership report packet with a malicious source address. Due to insufficient validation in the recvigmp function in src/igmpproxy.c, an invalid group record type can...

Malicious code in viktorparserctf4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00678c1855d2692f49a5643aecec33c4181e61a390c1852ee6b7200f0c2f3ca1 The package viktorparserctf4 was found to contain malicious code. Source: ghsa-malware 0961c05d572349a1c68d499506c8317678a9f123ebbeaf7540186a8cbf6f87...

MAL-2025-192651 Malicious code in viktorparserctf5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 224c79dee4e3a36c67bd12a6cc3f0578d4eb4fe75dd92e3dde8aae08ce646fee The package viktorparserctf5 was found to contain malicious code. Source: ghsa-malware 49d2b2440876d75785bb3d21a9f41cb3226ab45155823ae19b472b367e993b...

MAL-2025-192619 Malicious code in adk-github (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee46eaaea8bb0b2c04c936cd56cf6c030b92c551fe72a435a680680bc4b38bf9 The package adk-github was found to contain malicious code. Source: ghsa-malware feba07c14c2a8afde4296fe5a5c92d7bbec73e06a94fbc29edbd525f98e3ef42 Any...

MAL-2025-192641 Malicious code in tailwind-color-shine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a354c1527256b0cbb0309429b90ad036ded6b2cc1b2d29b8f2809af26f718cf7 The package tailwind-color-shine was found to contain malicious code. Source: ghsa-malware...

Malicious code in chai-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b74105dd25d6c4527e469282746ab5847ca41c5f21873099aa73bcf848f99432 The package chai-async was found to contain malicious code. Source: ghsa-malware 5eadd1bc38807a3c5bcec1c37a5d1a1de8bf81bfed4a5a7ba235a1e6f8ec34aa Any...

Malicious code in ctfparsertna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52cd5612214cb1fd0ed34899c5e686c4fdbecb4a820e170a3589987c20b9b3da The package ctfparsertna was found to contain malicious code. Source: ghsa-malware 90b9a48b58422c5d9853769c983bd04388558c312be191e3bfd8a82158214d38 A...

Malicious code in react-enhanced-glow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d6a21a6e0e2094ca1f9327d83a0c38da77bd3b8f8ffbad317ef4530a7d14c45 The package react-enhanced-glow was found to contain malicious code. Source: ghsa-malware...

CVE-2025-66174

CVE-2025-66174 describes an improper authentication vulnerability in certain Hikvision DVRs related to serial-port authentication. An attacker with physical access could connect to affected devices and execute commands due to the flawed authentication implementation. The vulnerability is document...

CVE-2025-66173

There is a privilege escalation vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an attacker with physical access could exploit this vulnerability by connecting to the affected products and gaining access to an unrestricted...

CVE-2025-50681

Summary: CVE-2025-50681 affects igmpproxy 0.4 before commit 2b30c36, allowing remote attackers to cause a denial of service (application crash) by sending crafted IGMPv3 membership reports with a malicious source address. The root cause is insufficient validation in recv_igmp() in src/igmpproxy.c...

Siemens LOGO! 8 BM Devices Buffer Copy Without Checking Size of Input (CVE-2025-40815)

A vulnerability has been identified in - LOGO! 12/24RCE 6ED1052-1MD08-0BA2 All versions - LOGO! 12/24RCEo 6ED1052-2MD08-0BA2 All versions - LOGO! 230RCE 6ED1052-1FB08-0BA2 All versions - LOGO! 230RCEo 6ED1052-2FB08-0BA2 All versions - LOGO! 24CE 6ED1052-1CC08-0BA2 All versions - LOGO! 24CEo...

CVE-2025-50681

igmpproxy 0.4 before commit 2b30c36 allows remote attackers to cause a denial of service application crash via a crafted IGMPv3 membership report packet with a malicious source address. Due to insufficient validation in the recvigmp function in src/igmpproxy.c, an invalid group record type can...

PT-2025-52416

There is an improper authentication vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an attacker with physical access could exploit this vulnerability by connecting to the affected products and run a series of commands...

PT-2025-52453

igmpproxy 0.4 before commit 2b30c36 allows remote attackers to cause a denial of service application crash via a crafted IGMPv3 membership report packet with a malicious source address. Due to insufficient validation in the recv igmp function in src/igmpproxy.c, an invalid group record type can...

CVE-2025-14884 D-Link DIR-605 Firmware Update Service command injection

A vulnerability was detected in D-Link DIR-605 202WWB03. Affected by this issue is some unknown functionality of the component Firmware Update Service. Performing manipulation results in command injection. The attack can be initiated remotely. The exploit is now public and may be used. This...

CVE-2025-14884

The CVE-2025-14884 entry concerns a remote command-injection vulnerability in the Firmware Update Service of D-Link DIR-605 (version 202WWB03). The issue stems from a flaw in the firmware update component, allowing an attacker to inject commands over the network. The exploit is public, and affect...

CVE-2025-14884 D-Link DIR-605 Firmware Update Service command injection

A vulnerability was detected in D-Link DIR-605 202WWB03. Affected by this issue is some unknown functionality of the component Firmware Update Service. Performing manipulation results in command injection. The attack can be initiated remotely. The exploit is now public and may be used. This...

CVE-2025-10910 Gaining remote control over Govee devices

A flaw in the binding process of Govee’s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the attacker’s account, resulting in full control of the device and removal of the device from its legitimate owner’s account. The server‑side API allows device...

CVE-2025-10910

CVE-2025-10910 describes a binding-flaw in Govee’s cloud platform that allows a remote attacker to bind an existing online Govee device to the attacker’s account, granting full control and removing it from the legitimate owner’s account. The server-side API accepts identifiers (device, sku, type)...