MAL-2025-190560 Malicious code in mongoose-odm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f96769a7d9b829c0679f6d50c1f0c7cf119eb49605c5dc6d9b7b1a05c2b655c9 The package mongoose-odm was found to contain malicious code. Source: ghsa-malware f652b1e2a0f5c99554f46ab757d97e6038f7e5cac1d2c51a2a01851b744884f2 A...

Siemens SCALANCE and RUGGEDCOM Devices NULL Pointer Dereference (CVE-2024-50198)

iio: light: veml6030: fix IIO device retrieval from embedded device. The dev pointer that is received as an argument in the inilluminanceperiodavailableshow function references the device embedded in the IIO device, not in the i2c client. devtoiiodev must be used to accessthe right data. The...

Linux Distros Unpatched Vulnerability : CVE-2025-61663

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service DoS risk. This flaw is a Use-after-Free...

CVE-2025-63829

eProsima Fast-DDS v3.3 and before has an infinite loop vulnerability caused by integer overflow in the Timet:: fraction function...

Linux Distros Unpatched Vulnerability : CVE-2025-62799

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Fast DDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group . Prior to versions 3.4.1, 3.3.1, and 2.6.11, ...

Linux Distros Unpatched Vulnerability : CVE-2025-13229

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium...

Today’s threat landscape demands a proactive OT security strategy

Today’s threat landscape demands a proactive OT security strategy By John Fokker and Mo Cashman · November 18, 2025 Overview: The operational technology OT security landscape is undergoing rapid transformation, marked by an escalation in advanced threats. As reported in Trellix’s November...

CVE-2025-13223

Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2025-64756

Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c are...

Malicious code in chai-proxify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a90af91a26f042c0ac96b72df310de8ec15f6ab93634ff0547c9efb3e041cd15 The package chai-proxify was found to contain malicious code. Source: ghsa-malware 535f2bd89ddae3ece4cde5060e0e237009d5b0cdef1bce1061a3d420915b2e66 A...

Jailbreaking Large Vision Language Models in Intelligent Transportation Systems

Large Vision Language Models LVLMs demonstrate strong capabilities in multimodal reasoning and many real-world applications, such as visual question answering. However, LVLMs are highly vulnerable to jailbreaking attacks. This paper systematically analyzes the vulnerabilities of LVLMs integrated ...

GHSA-VC2M-M665-8XM2 vulnerabilities

Vulnerabilities for packages: python...

GHSA-HC7M-R6V8-HG9Q vulnerabilities

Vulnerabilities for packages: zellij, wizer, wasmcloud, zed, yara-x...

CVE-2025-7000

Removed by vendor...

PT-2025-47026

Name of the Vulnerable Software and Affected Versions General Industrial Controls Lynx+ Gateway affected versions not specified Description The embedded web server lacks critical authentication, potentially allowing a remote attacker to reset the device. This could lead to a complete remote...

CVE-2025-64530

The CVE describes a vulnerability in Apollo Federation’s composition logic: in versions prior to 2.9.5, 2.10.4, 2.11.5, and 2.12.1, queries could bypass access controls on interface types/fields by querying implementing object types/fields via inline fragments, due to user-defined access control ...

CVE-2025-36236

IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server formerly known as NIM master service nimesis could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request to write arbitrary files on the system...

pgAdmin 4 has command injection vulnerability on Windows systems

pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system commands by providing specially crafted file path input...

GHSA-RM79-X4G6-HVG5 pgAdmin 4 has command injection vulnerability on Windows systems

pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system commands by providing specially crafted file path input...

CVE-2025-12763 Command injection vulnerability allowing arbitrary command execution on Windows

pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system commands by providing specially crafted file path input...