EUVD-2024-29630

Malicious code in bioql PyPI...

CVE-2025-44012

An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We hav...

BELL-CVE-2025-39913

Bulletin has no description...

BELL-CVE-2025-39927

Bulletin has no description...

Unity Runtime 参数注入漏洞

Unity Runtime is an underlying system responsible for executing logic, rendering, physics and interaction from Unity, Inc. in the United States. A parameter injection vulnerability exists in versions of Unity Runtime prior to 2025-10-02, which stems from a parameter injection that could lead to t...

The vulnerability of software for discrete event simulation and automation in Rockwell Automation Arena lies in insufficient validation of input data, allowing a perpetrator to execute arbitrary code.

The vulnerability of software for discrete event simulation and automation in Rockwell Automation Arena is related to insufficient verification of input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

BELL-CVE-2023-53513

Bulletin has no description...

BELL-CVE-2023-53514

Bulletin has no description...

DEBIAN-CVE-2022-50438

In the Linux kernel, the following vulnerability has been resolved: net: hinic: fix memory leak when reading function table When the input parameter idx meets the expected case option in hinicdbggetfunctable, readdata is not released. Fix it...

From Trace to Line: LLM Agent for Real-World OSS Vulnerability Localization

Large language models show promise for vulnerability discovery, yet prevailing methods inspect code in isolation, struggle with long contexts, and focus on coarse function- or file-level detections - offering limited actionable guidance to engineers who need precise line-level localization and...

CVE-2025-56571

Finance.js v4.1.0 contains a Denial of Service DoS vulnerability via the IRR function’s depth parameter. Improper handling of the recursion/iteration limit can lead to excessive CPU usage, causing application stalls or crashes...

Security Bulletin:IBM Event Streams is vulnerable to Regular Expression Denial of Service (ReDoS) ( CVE-2025-1302).

Summary IBM Event Streams is vulnerable to Regular Expression Denial of Service ReDoS caused by Inefficient Regular Expression Complexity. This issue affects JavaScript code that is compiled using certain versions of Babel . Babel is a JavaScript transcompiler used for converting modern JavaScrip...

Vasion Print Virtual Appliance Host 安全漏洞

Vasion Print Virtual Appliance Host is a print management software from Vasion USA. A security vulnerability exists in Vasion Print Virtual Appliance Host versions prior to 25.1.102 that stems from the ability to skip SSL/TLS certificate validation, which could lead to remote code execution and...

CVE-2025-11049 Portabilis i-Educar unificacao-aluno improper authorization

A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /unificacao-aluno. Performing manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit is now public and may be used...

PT-2025-39613

Name of the Vulnerable Software and Affected Versions flytedesk Flytedesk Digital versions n/a through 20181101 Description A Cross-Site Request Forgery CSRF issue exists in flytedesk Flytedesk Digital, which also allows Stored Cross-Site Scripting XSS. Recommendations At the moment, there is no...

BELL-CVE-2025-39862

Bulletin has no description...

CVE-2025-59828 Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions

Claude Code is an agentic coding tool. Prior to Claude Code version 1.0.39, when using Claude Code with Yarn versions 2.0+, Yarn plugins are auto-executed when running yarn --version. This could lead to a bypass of the directory trust dialog in Claude Code, as plugins would be executed prior to t...

GO-2025-3971 DragonFly vulnerable to arbitrary file read and write on a peer machine in d7y.io/dragonfly

DragonFly vulnerable to arbitrary file read and write on a peer machine in d7y.io/dragonfly...

Cisco IOS and IOS XE Software TACACS+ Authentication Bypass Vulnerability

A vulnerability in the implementation of the TACACS+ protocol in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to view sensitive data or bypass authentication. This vulnerability exists because the system does not properly check whether the required...

DEBIAN-CVE-2025-39867

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: fix null deref for empty set Blamed commit broke the check for a null scratch map: - if unlikely!m || !rawcpuptrm-scratch + if unlikely!rawcpuptrm-scratch This should have been "if !raw ...". Use the...