CVE-2025-65294

Aqara Hub devices including Camera Hub G3 4.1.90027, Hub M2 4.3.60027, and Hub M3 4.3.60025 contain an undocumented remote access mechanism enabling unrestricted remote command execution...

EUVD-2025-202626

An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can be spawned with the mobile application which opens a hidden page. This page, which is not available through the normal flows of the application, contains several devices which can be added to your...

CVE-2025-65820

An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can be spawned with the mobile application which opens a hidden page. This page, which is not available through the normal flows of the application, contains several devices which can be added to your...

CVE-2025-65820

An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can be spawned with the mobile application which opens a hidden page. This page, which is not available through the normal flows of the application, contains several devices which can be added to your...

2 Men Linked to China’s Salt Typhoon Hacker Group Likely Trained in a Cisco ‘Academy’

The names of two partial owners of firms linked to the Salt Typhoon hacker group also appeared in records for a Cisco training program—years before the group targeted Cisco’s devices in a spy campaign...

EUVD-2024-27069

An unauthorised attacker within bluetooth range may use an improper validation during the BLE connection request to deadlock the affected devices...

EUVD-2025-202406

An unauthenticated device registration vulnerability, caused by Improperly Controlled Modification of Dynamically-Determined Object Attributes, has been identified in the MXsecurity Series. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted JSON paylo...

Malicious code in real-time-tweet-streamer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 692b2a444eb479ec815e98413b99cd6cb677cf8be77edef431d8acf9d6c9e5c5 The package real-time-tweet-streamer was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192413 Malicious code in modules-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e707f153606cc933eafdfa4c883bf1092791f4fe0e80278d963dda8dd5291a46 The package modules-runtime was found to contain malicious code. Source: ghsa-malware e0c351f7e54009deb9f1a8fa206a6cc720b4a472a7b969018b50ae235fcac91...

MAL-2025-192409 Malicious code in ecmascript-runtime-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2749802bf68a2c601d1c2e22b4a398e096fca7b10d248305df538e8364390259 The package ecmascript-runtime-client was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192419 Malicious code in wasm-bindgen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b3b2a3d6aa85e6e53ccd0463891b26156f77f3b75134166dbc68c14ec2c6bd2 The package wasm-bindgen was found to contain malicious code. Source: ghsa-malware a1de8824d178cfc9806b7413eeb3661781e7e278f0b877117bddb857bddb592b A...

Malicious code in fastavro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8e01c7f0d2603f1d6cf541b7aa69c4bf9253ad1cd6b970a3337db957668a420 The package fastavro was found to contain malicious code. Source: ghsa-malware dfa83913e0a60ce0006e336f2f9f837aac0fa16d414d3c4c149562e19aed7474 Any...

CVE-2025-65297

Aqara Hub devices including Camera Hub G3 4.1.90027, Hub M2 4.3.60027, and Hub M3 4.3.60025 automatically collect and upload unencrypted sensitive information. Note that this occurs without disclosure or consent from the manufacturer...

CVE-2025-65297

Aqara Hub devices including Camera Hub G3 4.1.90027, Hub M2 4.3.60027, and Hub M3 4.3.60025 automatically collect and upload unencrypted sensitive information. Note that this occurs without disclosure or consent from the manufacturer...

CVE-2025-65828

An unauthenticated attacker within proximity of the Meatmeet device can issue several commands over Bluetooth Low Energy BLE to these devices which would result in a Denial of Service. These commands include: shutdown, restart, clear config. Clear config would disassociate the current device from...

CVE-2025-65820

An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can be spawned with the mobile application which opens a hidden page. This page, which is not available through the normal flows of the application, contains several devices which can be added to your...

PT-2025-50495

Name of the Vulnerable Software and Affected Versions Meatmeet Android Mobile Application version 1.1.2.0 Description An exported activity within the application can be initiated, revealing a hidden page. This page displays devices, including two that have not been publicly released. An attacker...

CVE-2025-65820

Meatmeet Android Mobile Application 1.1.2.0 is affected by CVE-2025-65820. An exported activity can spawn a hidden page listing devices, including unreleased ones, enabling attackers to gain insight into unreleased Meatmeet devices. The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H...

CVE-2025-65828

Meatmeet devices are vulnerable to an unauthenticated BLE-based Denial of Service. An attacker within BLE range can issue commands such as shutdown, restart, and clear config, which disassociates the device from its user and prevents receiving updates from the base station until the device is fix...

CVE-2025-24857

Improper access control for volatile memory containing boot code in Universal Boot Loader U-Boot before 2017.11 and Qualcomm chips IPQ4019, IPQ5018, IPQ5322, IPQ6018, IPQ8064, IPQ8074, and IPQ9574 could allow an attacker to execute arbitrary code...