Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.

...

drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw

...

PT-2025-36078

Name of the Vulnerable Software and Affected Versions: AppOpsService.java affected versions not specified Description: The software contains a flaw in multiple functions of AppOpsService.java due to improper input validation. This can allow an attacker to add a large amount of app ops, potentiall...

SUSE CVE-2025-9714

Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions xmlXPathRunEval, xmlXPathCtxtCompile, and xmlXPathEvalExpr were resetting recursion depth to zero before...

In Netwide Assembler (NASM) 2.14.02, stack consumption occurs in expr# functions in asm/eval.c. This potentially affects the relationships among expr0, expr1, expr2, expr3, expr4, expr5, and expr6 (and stdscan in asm/stdscan.c). This is similar to CVE-2019-6290 and CVE-2019-6291.

...

The vulnerability of the IntelliJ IDEA integrated development environment lies in the fact that functions from an unverified and uncontrolled area can be enabled, allowing a malicious actor to execute arbitrary plugins.

The vulnerability of the IntelliJ IDEA software development environment lies in the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability can allow attackers to execute arbitrary plugins...

The vulnerability of TP-Link KP303 device’s microprogramming software lies in the lack of authentication for critical functions. This allows attackers to execute arbitrary commands, cause malfunctions, or disclose protected information.

The vulnerability of TP-Link KP303 microprogramming software is related to the absence of authentication for critical functions. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands, cause service failures, or disclose protected information...

VulnCheck KEV: CVE-2023-50445

Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7, AR750 v4.3.7, AR300M v4.3.7, and B1300 v4.3.7., allows local attackers to execute arbitrary code via the getsystemlog and...

Linux Distros Unpatched Vulnerability : CVE-2025-27793

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 5.32.0,...

Security Bulletin: IBM Decision Optimization for Cloud Pak for Data is vulnerable to cross-site scripting attacks (CVE-2025-27793)

Summary There is a vulnerability in Vega used by IBM Decision Optimization for IBM Cloud Pak for Data. IBM Decision Optimization for IBM Cloud Pak for Data has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2025-27793 DESCRIPTION: Vega is a visualization grammar, a declarative form...

The vulnerability of the CLI loader component in Grub allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the GRUB loader’s CLI component is related to the lack of authentication for critical functions. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

ASB-A-365739560

In multiple functions of AppRestrictionsFragment.java, there is a possible way to bypass intent security check due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

Linux Distros Unpatched Vulnerability : CVE-2025-38569

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - benet: fix BUG when creating VFs benet crashes as soon as SRIOV VFs are created: kernel BUG at mm/vmalloc.c:3457! Oops: invalid opcode: 0000 1 SMP KASAN NOPTI...

CVE-2025-54710

Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Tiktok Feed: from n/a through = 1.0.21...

Linux Distros Unpatched Vulnerability : CVE-2019-8427

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters. CVE-2019-8427 Note that Nessus relies on...

Malicious code in azure-functions-templates-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b042b6071c2aede4bcb5d299376c83daa1a911adb92cc27204804dba0b29dbc3 The OpenSSF Package Analysis project identified 'azure-functions-templates-build' @ 1.0.0 npm as malicious. It is considered malicious because: ...

MAL-2025-42126 Malicious code in azure-functions-templates-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b042b6071c2aede4bcb5d299376c83daa1a911adb92cc27204804dba0b29dbc3 The OpenSSF Package Analysis project identified 'azure-functions-templates-build' @ 1.0.0 npm as malicious. It is considered malicious because: ...

PT-2025-44142

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to improper handling of device references, potentially leading to a use-after-free condition. Specifically, the issue arises from not correctly...

The Art of Hide and Seek: Making Pickle-Based Model Supply Chain Poisoning Stealthy Again

Pickle deserialization vulnerabilities have persisted throughout Python's history, remaining widely recognized yet unresolved. Due to its ability to transparently save and restore complex objects into byte streams, many AI/ML frameworks continue to adopt pickle as the model serialization protocol...

CVE-2025-9409

CVE-2025-9409 affects lostvip-com ruoyi-go up to version 2.1. The vulnerability is in modules/system/controller/CommonController.go, DownloadTmp/DownloadUpload, where manipulating the fileName parameter enables a path traversal attack. It is exploitable remotely, with publicly released exploits. ...