Malicious code in draw-with-twilio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 423b3d27265f2438de29b913385910b4d4eef30e2934306c1951196ab07f4a5d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in telehealth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1341fa0434bd6d34d4cd7c6e981f3454a6c1f5fc415c6fed9415ffa817d4721f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in display-fetch_stream (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 93a196cb5e04250355d4a4e51d12810d2324320559124570c03be4209dba9d1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fneves-my-test-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 815b581bf6795de9c99486eb17b7d30b47b6d5619cb296f97499f4149b9231c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in notifications-item (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97d85b541866edfdc9a987e188439cb632fc50a8841072cc43eef2d044f30c8a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cisco Meraki 16.2 / 17 / 18.1 < 18.107.13 / 18.2 < 18.211.6 / 19.1 < 19.1.8 DoS (cisco-sa-meraki-mx-vpn-dos-sM5GCfm7)

The version of the remote Cisco Meraki device is 16.2, 17, 18.1 prior to 18.107.13, 18.2 prior to 18.211.6, or 19.1 prior to 19.1.8. It is, therefore, potentially affected by a denial of service vulnerability as referenced in the cisco-sa-meraki-mx-vpn-dos-QTRHzG2 advisory: - A vulnerability in t...

PT-2025-27637 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue concerns the Linux kernel on arm64 devices, specifically the qcom x1e80100, where the GPU does not automatically throttle its speed when reaching high temperatures, unlike th...

PT-2025-29424 · Lb Link · Lb-Link Bl-Ac3600 +5

Name of the Vulnerable Software and Affected Versions: LB-LINK BL-AC1900, BL-AC2100 AZ3, BL-AC3600, BL-AX1800, BL-AX5400P, BL-WR9000 versions up to 20250702 Description: A critical vulnerability exists in the Web Interface component of the affected devices. The vulnerability is related to the...

USN-7607-2 linux-fips vulnerabilities

It was discovered that a use-after-free vulnerability existed in the Bluetooth stack in the Linux kernel. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2022-3640 Several security issues were discovered in the Linux kernel. An...

USN-7607-2: Linux kernel (FIPS) vulnerabilities

It was discovered that a use-after-free vulnerability existed in the Bluetooth stack in the Linux kernel. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2022-3640 Several security issues were discovered in the Linux kernel. An...

USN-7607-1: Linux kernel vulnerabilities

It was discovered that a use-after-free vulnerability existed in the Bluetooth stack in the Linux kernel. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2022-3640 Several security issues were discovered in the Linux kernel. An...

USN-7607-1 linux, linux-aws, linux-lts-xenial vulnerabilities

It was discovered that a use-after-free vulnerability existed in the Bluetooth stack in the Linux kernel. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2022-3640 Several security issues were discovered in the Linux kernel. An...

CVE-2025-34066

An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle MITM attacks...

CVE-2025-34055

An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint, which interfaces with the ActionD daemon. Authenticated users can invoke the DoShellCmd operation, passing arbitrary input via the strCmd parameter. This input is executed...

CVE-2025-34056

An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the PwdGrp.cgi endpoint, which handles user and group management operations. Authenticated users can supply input through the pwd or grp parameters, which are directly embedded into system commands without...

CVE-2025-34053

An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr function is used to identify ".cab" requests, allowing any URL containing ".cab" to bypass authentication and access protected endpoints...

CVE-2025-34050

A cross-site request forgery CSRF vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user’s browser session, allow unauthorized changes to the device configuration...

Bluetooth vulnerability in audio devices can be exploited to spy on users

Researchers have found vulnerabilities in 29 Bluetooth devices like speakers, earbuds, headphones, and wireless microphones from reputable companies including Sony, Bose, and JBL. The vulnerabilities could be exploited to spy on users, and even steal information from the device. The researchers w...

CVE-2025-34066 AVTECH IP camera, DVR, and NVR Devices Unauthenticated Information Disclosure

An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle MITM attacks...

CVE-2025-34066

CVE-2025-34066 affects AVTECH IP cameras, DVRs, and NVRs. The root cause is improper certificate validation caused by using wget with --no-check-certificate in scripts such as SyncCloudAccount.sh and SyncPermit.sh, exposing HTTPS communications to MITM attacks. Affected products are AVTECH device...