MINI-62HX-539P-PJCM

Bulletin has no description...

MINI-W54V-RPM7-Q8FH

Bulletin has no description...

MINI-W48R-CPQW-9RP3

Bulletin has no description...

MINI-M7WR-4RG6-82X2

Bulletin has no description...

MINI-J785-PPC2-6XHG

Bulletin has no description...

MINI-C7F7-RMRX-25XX

Bulletin has no description...

MINI-39CM-378M-RV95

Bulletin has no description...

Cross-site Scripting (XSS)

Overview @cosmos.gl/graph is a GPU-based force graph layout and rendering Affected versions of this package are vulnerable to Cross-site Scripting XSS due to writing a user-controllable HTML string directly to the DOM without sanitization. An attacker can execute arbitrary JavaScript code in a...

EUVD-2025-37372

Totolink LR350 v9.3.5u.6369B20220309 was discovered to contain a stack overflow via the password parameter in the sub426EF8 function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

UBUNTU-CVE-2025-57108

Kitware VTK Visualization Toolkit through 9.5.0 contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader. The vulnerability manifests during mesh object copy operations where vector members are accessed after the underlying memory has been freed, specifically when handling GLTF files...

CVE-2025-64362 WordPress K Elements plugin < 5.5.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SeventhQueen K Elements k-elements allows DOM-Based XSS.This issue affects K Elements: from n/a through 5.5.0...

When APIs Become Attack Paths: What the Q3 2025 ThreatStats Report Tells Us

Wallarm’s latest Q3 2025 API ThreatStats report link placeholder reveals that API vulnerabilities, exploits, and breaches are not just increasing; they’re evolving. Malicious actors are shifting from code-level weaknesses to business logic flaws, from web apps to partner integrations, and from RE...

CISA and NSA Issue Urgent Guidance to Secure WSUS and Microsoft Exchange Servers

The U.S. Cybersecurity and Infrastructure Security Agency CISA and National Security Agency NSA, along with international partners from Australia and Canada, have released guidance to harden on-premise Microsoft Exchange Server instances from potential exploitation. "By restricting administrative...

usb: gadget: f_ecm: Refactor bind path to use __free()

...

Vulnerability in Keras Model.load_model Leading to Arbitrary Local File Loading and SSRF

...

SUSE CVE-2025-40093

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fecm: Refactor bind path to use free After an bind/unbind cycle, the ecm-notifyreq is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer...

CVE-2025-63885

A stored cross-site scripting XSS vulnerability in AIxBlock commit 04f305 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the modeldesc field...

Exploiting Latent Space Discontinuities for Building Universal LLM Jailbreaks and Data Extraction Attacks

The rapid proliferation of Large Language Models LLMs has raised significant concerns about their security against adversarial attacks. In this work, we propose a novel approach to crafting universal jailbreaks and data extraction attacks by exploiting latent space discontinuities, an architectur...

MINI-W445-8G58-GPF6

Bulletin has no description...

CVE-2025-11998 HP Card Readers (B Models) – Potential Information Disclosure

The following HP Card Readers B Models X3D03B & Y7C05B are potentially vulnerable to information disclosure, allowing prior user identity to be inherited under certain conditions —e.g., when an NFC device such as a smartphone/smartwatches is in proximity during a card swipe event...