CVE-2025-29909

CVE-2025-29909 affects CryptoLib (NASA) up to version 1.3.3: a heap buffer overflow in Crypto_TC_ApplySecurity() can be triggered by crafting a malformed Telecommand (TC) frame, leading to out-of-bounds writes with DoS and, under certain conditions, remote code execution. The vulnerability impact...

CVE-2025-29909 CryptoLib's Crypto_TC_ApplySecurity() Has a Heap Buffer Overflow Vulnerability

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures SDLS-EP to secure communications between a spacecraft running the core Flight System cFS and a ground station. In versions 1.3.3 and prior, a heap buffer overflow vulnerability in...

CVE-2024-49897 affecting package kernel for versions less than 6.6.64.2-9

CVE-2024-49897 affecting package kernel for versions less than 6.6.64.2-9. A patched version of the package is available...

CVE-2024-56761 affecting package kernel for versions less than 6.6.76.1-1

CVE-2024-56761 affecting package kernel for versions less than 6.6.76.1-1. A patched version of the package is available...

CVE-2024-43911 affecting package kernel for versions less than 6.6.64.2-9

CVE-2024-43911 affecting package kernel for versions less than 6.6.64.2-9. A patched version of the package is available...

CVE-2024-44940 affecting package kernel for versions less than 5.15.176.3-1

CVE-2024-44940 affecting package kernel for versions less than 5.15.176.3-1. A patched version of the package is available...

SUSE CVE-2025-2357

A vulnerability was found in DCMTK 3.6.9. It has been declared as critical. This vulnerability affects unknown code of the component dcmjpls JPEG-LS Decoder. The manipulation leads to memory corruption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be...

GHSA-XC76-5PF9-MX8M In Azle, calling `setTimer` causes infinite loop of timers

Impact Calling setTimer in Azle versions 0.27.0, 0.28.0, and 0.29.0 causes an immediate infinite loop of timers to be executed on the canister, each timer attempting to clean up the global state of the previous timer. The infinite loop will occur with any valid invocation of setTimer. Patches The...

CVE-2025-27101

Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, when copying any parent directory to a folder in the /temp/ directory, all files in that parent directory are copied, including files which the user should not have access to. All users of t...

CVE-2025-27144 affecting package packer for versions less than 1.9.5-6

CVE-2025-27144 affecting package packer for versions less than 1.9.5-6. A patched version of the package is available...

Security Bulletin: Vulnerability in FOS firmware used by IBM b-type SAN directors and switches.

Summary The b-type products are vulnerable due to an OpenSSL issue in the FOS firmware. The vulnerability has been addressed and can be resolved by applying the FOS code level listed below. Vulnerability Details CVEID:CVE-2023-5363 DESCRIPTION: OpenSSL could allow a remote attacker to obtain...

GHSA-4WF3-5QJ9-368V IBC-Go: Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt

Name: ISA-2025-001: Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt Component: IBC-Go Criticality: High Considerable Impact; Likely Likelihood per ACMv1.2 Affected versions: IBC-Go = v7; Earlier IBC-Go versions MAY also be affected. Affected users: Validator...

CVE-2025-27407 Remote code execution when loading a crafted GraphQL schema

graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in GraphQL::Schema.fromintrospection or GraphQL::Schema::Loader.load can result in remote code...

CVE-2025-27407 Remote code execution when loading a crafted GraphQL schema

graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in GraphQL::Schema.fromintrospection or GraphQL::Schema::Loader.load can result in remote code...

GHSA-9M3Q-RHMV-5Q44 Out-of-bounds Read in Ruby JSON Parser

Impact A specially crafted document could cause an out of bound read, most likely resulting in a crash. Versions 2.10.0 and 2.10.1 are impacted. Older versions are not. Patches Version 2.10.2 fixes the problem. Workarounds None...

CVE-2025-1497

A vulnerability, that could result in Remote Code Execution RCE, has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to execute arbitrary Python code. Vendor commented out vulnerable line, further usage of the software requires uncommenting it and thus accepting t...

CVE-2025-27794 Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite

Flarum is open-source forum software. A session hijacking vulnerability exists in versions prior to 1.8.10 when an attacker-controlled authoritative subdomain under a parent domain e.g., subdomain.host.com sets cookies scoped to the parent domain .host.com. This allows session token replacement f...

PT-2025-11048 · Json · Json

Name of the Vulnerable Software and Affected Versions: JSON versions 2.10.0 through 2.10.1 Description: A specially crafted document could cause an out of bound read, most likely resulting in a crash. Recommendations: For versions 2.10.0 and 2.10.1, update to version 2.10.2 to resolve the issue. ...

PT-2025-12495 · D Link · D-Link Dap-1620

Name of the Vulnerable Software and Affected Versions: D-Link DAP-1620 version 1.03 Description: A critical vulnerability has been found in the D-Link DAP-1620, affecting the mod graph auth uri handler function of the Authentication Handler component. This vulnerability leads to a stack-based...

CVE-2025-27101 Broken Access Control in Opal filesystem's copy functionality exposes all user data

Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, when copying any parent directory to a folder in the /temp/ directory, all files in that parent directory are copied, including files which the user should not have access to. All users of t...