GHSA-8F82-53H8-2P34 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, splunk-otel-collector-fips, vault...

CVE-2025-20262 Cisco Nexus 3000 and 9000 Series Switches Protocol Independent Multicast Version 6 Denial of Service Vulnerability

A vulnerability in the Protocol Independent Multicast Version 6 PIM6 feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, low-privileged, remote attacker to trigger a crash of the PIM6 process, resulting in a denia...

CVE-2025-20262

CVE-2025-20262 affects Cisco Nexus 3000/9000 NX-OS standalone in PIM6. The issue arises from improper processing of PIM6 ephemeral data queries, allowing an authenticated, low-privileged remote attacker to crash the PIM6 process and cause DoS via adjacency flaps and DoS of PIM6/ephemeral query pr...

Embeded Malicious Code

Overview @nx/devkit is an AI-first build platform that connects everything from your editor to CI. Helping you deliver fast, without breaking things. This package contains a set of utilities for creating Nx plugins. Affected versions of this package are vulnerable to Embeded Malicious Code throug...

PT-2025-34888 · Cisco · Cisco Nexus 3000 Series Switches +1

Name of the Vulnerable Software and Affected Versions: Cisco Nexus 3000 Series Switches Cisco Nexus 9000 Series Switches Description: A vulnerability in the Protocol Independent Multicast Version 6 PIM6 feature could allow an authenticated, low-privileged, remote attacker to trigger a crash of th...

CVE-2025-55443

Telpo MDM 1.4.6 thru 1.4.9 for Android contains sensitive administrator credentials and MQTT server connection details IP/port that are stored in plaintext within log files on the device's external storage. This allows attackers with access to these logs to: 1. Authenticate to the MDM web platfor...

CVE-2025-55443

Affected product: Telpo MDM Android, versions 1.4.6–1.4.9. Vulnerability: Sensitive administrator credentials and MQTT server connection details are stored in plaintext in log files on external storage, enabling access to the MDM web platform to perform administrative operations and to the MQTT s...

Subverting AIOps Systems Through Poisoned Input Data

In this input integrity attack against an AI system, researchers were able to fool AIOps tools: AIOps refers to the use of LLM-based agents to gather and analyze application telemetry, including system logs, performance metrics, traces, and alerts, to detect problems and then suggest or carry out...

CVE-2025-38559

In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/pmt: fix a crashlog NULL pointer access Usage of the intelpmtread for binary sysfs, requires a pcidev. The current use of the endpoint value is only valid for telemetry endpoint usage. Without the ep, the...

CVE-2025-38559 platform/x86/intel/pmt: fix a crashlog NULL pointer access

In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/pmt: fix a crashlog NULL pointer access Usage of the intelpmtread for binary sysfs, requires a pcidev. The current use of the endpoint value is only valid for telemetry endpoint usage. Without the ep, the...

CVE-2025-38559

CVE-2025-38559 (Linux kernel) affects the Intel PMT subsystem on x86 platforms. The issue is a NULL pointer dereference in intel_pmt_read() when an ep (endpoint) is missing, leading to kernel oops in crashlog handling. The fix, as described, augments intel_pmt_entry with a pointer to the pcidev t...

Malicious code in @mintstudiouicore/telemetry (npm)

The package @mintstudiouicore/telemetry was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-9104 Malicious code in @mintstudiouicore/telemetry (npm)

The package @mintstudiouicore/telemetry was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

PT-2025-32980 · Zkteco · Zkteco Wl20

Name of the Vulnerable Software and Affected Versions: ZKTeco WL20 affected versions not specified Description: The device stores MQTT credentials and endpoints in plaintext within the firmware. An attacker with physical access can extract the firmware and analyze the binary data to retrieve the...

Linux Distros Unpatched Vulnerability : CVE-2024-21243

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Telemetry. Supported versions that are affected are 8.4.2 and prior and 9.0.1 and...

CVE-2025-52586

The MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext without encryption or obfuscation. This vulnerability may allow an attacker with access to a local network to intercept, manipulate, replay, or forge critical data, including read/write...

CVE-2025-52586

The CVE-2025-52586 issue affects EG4 Electronics EG4 Inverters, where MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext. The root impact described across sources is interception, manipulation, replay, or forging of sensitive commands/data (voltag...

GPU in the Blind Spot: Overlooked Security Risks in Transportation

Graphics processing units GPUs are becoming an essential part of the intelligent transportation system ITS for enabling video-based and artificial intelligence AI based applications. GPUs provide high-throughput and energy-efficient computing for tasks like sensor fusion and roadside video...

Malicious code in internal-plugin-telemetry-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1d9d94ab30d6ec88b722127b9f7fcd84c80e7e5bc2fda3c7865104dea4a0fcc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Data-Plane Telemetry to Mitigate Long-Distance BGP Hijacks

Poor security of Internet routing enables adversaries to divert user data through unintended infrastructures hijack. Of particular concern -- and the focus of this paper -- are cases where attackers reroute domestic traffic through foreign countries, exposing it to surveillance, bypassing legal...