CVE-2025-10061

An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of certain accumulator functions when additional parameters are specified within the $group operation. This vulnerability could lead to deni...

Malicious code in @zalastax/nolb-_functions-io-labs-perfo (npm)

The package @zalastax/nolb-functions-io-labs-perfo was found to contain malicious code...

MAL-2025-43004 Malicious code in @zalastax/nolb-_functions-io-labs-perfo (npm)

The package @zalastax/nolb-functions-io-labs-perfo was found to contain malicious code...

MAL-2025-43005 Malicious code in @zalastax/nolb-_functions-io-labs-perfor (npm)

The package @zalastax/nolb-functions-io-labs-perfor was found to contain malicious code...

SQL Injection

apachesuperset is vulnerable to SQL Injection. The vulnerability is due to improper enforcement of the DISALLOWEDSQLFUNCTIONS security feature, which allows an attacker with SQL Lab access to circumvent the denylist using a special inline block and execute restricted SQL functions...

PT-2025-36333

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 14.8.2 Description ImageMagick is free and open-source software used for editing and manipulating digital images. The software includes insecure functions: SeekBlob, which allows advancing the stream offset beyond...

CVE-2025-10061: Improper Input Validation

An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of certain accumulator functions when additional parameters are specified within the $group operation. This vulnerability could lead to deni...

mongodb -- Malformed $group Query May Cause MongoDB Server to Crash

[email protected] reports: An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of certain accumulator functions when additional parameters are specified within the $group operation. This...

Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions

...

serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO

...

Stack exhaustion in all Parse functions in go/parser

...

Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.

...

drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw

...

PT-2025-36078

Name of the Vulnerable Software and Affected Versions: AppOpsService.java affected versions not specified Description: The software contains a flaw in multiple functions of AppOpsService.java due to improper input validation. This can allow an attacker to add a large amount of app ops, potentiall...

SUSE CVE-2025-9714

Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions xmlXPathRunEval, xmlXPathCtxtCompile, and xmlXPathEvalExpr were resetting recursion depth to zero before...

In Netwide Assembler (NASM) 2.14.02, stack consumption occurs in expr# functions in asm/eval.c. This potentially affects the relationships among expr0, expr1, expr2, expr3, expr4, expr5, and expr6 (and stdscan in asm/stdscan.c). This is similar to CVE-2019-6290 and CVE-2019-6291.

...

VulnCheck KEV: CVE-2023-50445

Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7, AR750 v4.3.7, AR300M v4.3.7, and B1300 v4.3.7., allows local attackers to execute arbitrary code via the getsystemlog and...

The vulnerability of the IntelliJ IDEA integrated development environment lies in the fact that functions from an unverified and uncontrolled area can be enabled, allowing a malicious actor to execute arbitrary plugins.

The vulnerability of the IntelliJ IDEA software development environment lies in the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability can allow attackers to execute arbitrary plugins...

The vulnerability of TP-Link KP303 device’s microprogramming software lies in the lack of authentication for critical functions. This allows attackers to execute arbitrary commands, cause malfunctions, or disclose protected information.

The vulnerability of TP-Link KP303 microprogramming software is related to the absence of authentication for critical functions. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands, cause service failures, or disclose protected information...

Linux Distros Unpatched Vulnerability : CVE-2025-27793

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 5.32.0,...