assimp: Open Asset Import Library Assimp ASE File ASEParser.cpp ParseLV4MeshBonesVertices heap-based overflow

A flaw has been found in the Open Asset Import Library assimp. In affected versions, a malformed ASE file may trigger a heap-based buffer overflow, which may lead to an application crash or other undefined behavior...

org.keycloak/keycloak-model-storage-service: Variable injection into environment variables

A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are...

org.keycloak/keycloak-model-storage-service: Variable injection into environment variables

A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are...

Service workers could reveal script base URL due to dynamic `import()`. This vulnerability affects Firefox < 113.

...

SUNRPC: fix a memleak in gss_import_v2_context

...

CVE-2025-9800

A weakness has been identified in SimStudioAI sim up to ed9b9ad83f1a7c61f4392787fb51837d34eeb0af. Affected by this issue is the function Import of the file apps/sim/app/api/files/upload/route.ts of the component HTML File Parser. Executing manipulation of the argument File can lead to unrestricte...

Arm Mbed TLS before 2.16.5 allows attackers to obtain sensitive information (an RSA private key) by measuring cache usage during an import.

...

GHSA-MW26-5G2V-HQW3 DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more

Summary Python class pollution is a novel vulnerability categorized under CWE-915. The Delta class is vulnerable to class pollution via its constructor, and when combined with a gadget available in DeltaDiff itself, it can lead to Denial of Service and Remote Code Execution via insecure Pickle...

CVE-2025-9365

Fuji Electric FRENIC-Loader 4 is vulnerable to a deserialization of untrusted data when importing a file through a specified window, which may allow an attacker to execute arbitrary code...

CVE-2025-9365

Fuji Electric FRENIC-Loader 4 is vulnerable to unsafe deserialization of user-submitted serialized data when importing a file via a specific window, which may allow arbitrary code execution. Affected product: Fuji Electric FRENIC-Loader 4 (inverters). Root cause: deserialization of untrusted data...

CVE-2025-9365 Fuji Electric FRENIC-Loader 4 Deserialization of Untrusted Data

Fuji Electric FRENIC-Loader 4 is vulnerable to a deserialization of untrusted data when importing a file through a specified window, which may allow an attacker to execute arbitrary code...

PT-2025-35828

Name of the Vulnerable Software and Affected Versions Fuji Electric FRENIC-Loader 4 affected versions not specified Description Fuji Electric FRENIC-Loader 4 is susceptible to deserialization of untrusted data when importing a file through a specified window. This may allow an attacker to execute...

CVE-2025-9365: Deserialization of Untrusted Data

Fuji Electric FRENIC-Loader 4 is vulnerable to a deserialization of untrusted data when importing a file through a specified window, which may allow an attacker to execute arbitrary code...

Security update for python-future

This update for python-future fixes the following issues: CVE-2025-50817: Fixed arbitrary code execution via the automatic import of file test.py bsc1248124 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

CVE-2025-5662

A deserialization vulnerability exists in the H2O-3 REST API POST /99/ImportSQLTable that affects all versions up to 3.46.0.7. This vulnerability allows remote code execution RCE due to improper validation of JDBC connection parameters when using a Key-Value format. The vulnerability is present i...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the POST /99/ImportSQLTable endpoint, which does not require authentication. An attacker can execute arbitrary code by sending specially crafted requests to the REST API endpoint. Details...

CVE-2025-5662 Deserialization Vulnerability in h2oai/h2o-3

A deserialization vulnerability exists in the H2O-3 REST API POST /99/ImportSQLTable that affects all versions up to 3.46.0.7. This vulnerability allows remote code execution RCE due to improper validation of JDBC connection parameters when using a Key-Value format. The vulnerability is present i...

CVE-2025-5662 Deserialization Vulnerability in h2oai/h2o-3

A deserialization vulnerability exists in the H2O-3 REST API POST /99/ImportSQLTable that affects all versions up to 3.46.0.7. This vulnerability allows remote code execution RCE due to improper validation of JDBC connection parameters when using a Key-Value format. The vulnerability is present i...

CVE-2025-5662

CVE-2025-5662 describes a deserialization vulnerability in H2O-3 REST API (POST /99/ImportSQLTable) affecting all versions up to 3.46.0.7. Improper validation of JDBC connection parameters (Key-Value format) can lead to remote code execution (RCE). The issue involves MySQL JDBC Driver 8.0.19 and ...

kernel: crypto: algif_hash - fix double free in hash_accept

In the Linux kernel, the following vulnerability has been resolved: crypto: algifhash - fix double free in hashaccept If accept2 is called on socket type algifhash with MSGMORE flag set and cryptoahashimport fails, sk2 is freed. However, it is also freed in afalgrelease, leading to...