CVE-2025-65960: Insufficient Type Distinction

Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57...

The vulnerability of the ValidateToken function in the PolicyServer server, a component of Trend Micro Endpoint Encryption (TMEE), allows a perpetrator to execute arbitrary code.

The vulnerability of the ValidateToken function in the PolicyServer server, a component of the Trend Micro Endpoint Encryption TMEE data encryption tool, is related to the use of outdated functions. Exploiting this vulnerability could allow an attacker operating remotely to execute arbitrary code...

The vulnerability of the DbAppDomain function on the PolicyServer server, a feature of Trend Micro Endpoint Encryption (TMEE), allows a malicious actor to circumvent security restrictions.

The vulnerability of the DbAppDomain function on the PolicyServer server, a component of the Trend Micro Endpoint Encryption TMEE data encryption solution, is related to the use of outdated functions. Exploiting this vulnerability could allow an attacker operating remotely to circumvent security...

MAL-2025-191013 Malicious code in stat-fns (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5395e07a1f1a743d77d42495c7eaf08cb0ced22a0b0883b53b5adf78beef28a The package stat-fns was found to contain malicious code. Source: ghsa-malware 6c2e197e85b015babcf3a2073e3f76b980a3ae924a49a20d9c1648c610d7d3c0 Any...

Malicious code in react-native-worklet-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ed2ae3214c7915580ec4f119fc2fc1ee0e071e2deea48ef419973982180aa9c The package react-native-worklet-functions was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190857 Malicious code in react-native-worklet-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ed2ae3214c7915580ec4f119fc2fc1ee0e071e2deea48ef419973982180aa9c The package react-native-worklet-functions was found to contain malicious code. Source: ghsa-malware...

Linux Distros Unpatched Vulnerability : CVE-2025-40213

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: MGMT: fix crash in setmeshsync and setmeshcomplete There is a BUG: KASAN: stack-out-of- bounds in setmeshsync due to memcpy from badly declared...

CVE-2025-0504 Black Duck SCA Project Privilege Escalation

Black Duck SCA versions prior to 2025.10.0 had user role permissions configured in an overly broad manner. Users with the scoped Project Manager user role with the Global User Read access permission enabled access to certain Project Administrator functionalities which should have be inaccessible...

TencentOS Server 2: python-setuptools (TSSA-2024:0503)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0503 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

CVE-2025-63604

A code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that allows remote code execution through insufficient input validation in the executequery method. The vulnerability stems from the exposure of dangerous Python built-in functions import, getattr, hasattr in...

The vulnerability of the Kapsch TrafficCom RIS-9260 road communication module lies in the lack of authentication for a critical function. This allows a violator to execute arbitrary code and increase their privileges.

The vulnerability of the Kapsch TrafficCom RIS-9260 road communication module’s microprogramming software lies in the lack of authentication for critical functions. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands and increase their privileges...

The vulnerability of the user interface of the Spectrum Power 4 software allows a perpetrator to execute arbitrary commands.

The vulnerability of the Spectrum Power 4 software’s user interface lies in the inclusion of functions from an unreliable and uncontrolled area. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2025-47086

Name of the Vulnerable Software and Affected Versions WeiYe-Jing datax-web versions up to 2.1.2 Description A flaw exists in the Job Handler component of WeiYe-Jing datax-web, specifically within the remove, update, pause, start, and triggerJob functions. This issue results in improper access...

Uncontrolled Search Path Element

Overview aws-advanced-nodejs-wrapper is a Affected versions of this package are vulnerable to Uncontrolled Search Path Element due to unqualified SQL function and operator references in the database dialect components. An attacker can execute malicious code with elevated privileges by creating...

Uncontrolled Search Path Element

Overview Affected versions of this package are vulnerable to Uncontrolled Search Path Element due to unqualified SQL function and operator references in the database dialect components. An attacker can execute malicious code with elevated privileges by creating crafted functions with names that...

CVE-2025-12967

An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rdssuperuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service RDS users. We recommend customers...

CLSA-2025-1763043157 Fix CVE(s): CVE-2025-55160

SECURITY UPDATE: UBSan function-type-mismatch - debian/patches/CVE-2025-55160.patch: Fix UBSan function-type-mismatch in cloning functions - CVE-2025-55160...

Siemens SIMATIC S7-1500 Missing Encryption of Sensitive Data (CVE-2022-46908)

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC S7-1500 Improper Input Validation (CVE-2019-19244)

Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, In...

Siemens SIMATIC S7-1500 Improper Initialization (CVE-2020-11655)

SQLite through 3.31.1 allows attackers to cause a denial of service segmentation fault via a malformed window-function query because the AggInfo object's initialization is mishandled. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...