CVE-2025-4476

A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 Unauthorized HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed...

SafeTrans: LLM-Assisted Transpilation from C to Rust

Rust is a strong contender for a memory-safe alternative to C as a "systems" programming language, but porting the vast amount of existing C code to Rust is a daunting task. In this paper, we evaluate the potential of large language models LLMs to automate the transpilation of C code to idiomatic...

CVE-2025-46803

A flaw was found in Screen. The default mode for pseudo-terminals PTYs allocated by Screen was changed from 0620 to 0622. This vulnerability allows public writes to any PTYs in the system. Mitigation No mitigation is currently available that meets Red Hat Product Security’s standards for usabilit...

Schneider Electric Galaxy VS, Galaxy VL, Galaxy VXL (Update A)

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...

Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2025-20323)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20323 advisory. - selftest/x86/bugs: Add selftests for ITS Pawan Gupta Orabug: 37863726 CVE-2024-28956 - x86/its: Align RETs in BHB clear sequence to avoid thunking Pawan...

ROS-2-652

2.652 OpenVPN Authentication Bypass CVE-2020-15078 1. Vulnerability Description: The vulnerability allows a remote attacker to bypass authentication and access restrictions to leak VPN configuration data. The issue only occurs on servers that are configured to use deferredauth. Under certain...

PT-2025-20457 · D Link · D-Link Dir-619L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L version 2.04B04 Description: A critical issue affects the wake on lan function, where manipulation of the mac argument leads to command injection. This can be initiated remotely. The vendor was contacted about this disclosure...

Restrict route by IP - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-047

The Restrict route by IP module provides an interface to manage route restriction by IP address. The module doesn't sufficiently protect certain routes from CSRF attacks. This vulnerability is mitigated by the fact that you need to know the route machine name...

PT-2025-19904 · Logstash · Logstash

Name of the Vulnerable Software and Affected Versions: Logstash affected versions not specified Description: The issue is related to improper certificate validation in Logstash's TCP output, which could lead to a man-in-the-middle MitM attack in "client" mode. This occurs because hostname...

PT-2025-19920 · Tcman · Tcman'S Gim

Name of the Vulnerable Software and Affected Versions: TCMAN's GIM version 11 Description: This issue allows an unauthenticated attacker to inject an SQL statement to obtain, update, and delete all information in the database. The vulnerability is found in the updatePassword endpoint, specificall...

PT-2025-19931 · D Link · D-Link Dir-880L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-880L versions up to 104WWb01 Description: A critical vulnerability was found in the Request Header Handler component, specifically affecting the function sub 16570 of the file /htdocs/ssdpcgi. The manipulation of the argument HTTP...

GHSA-892P-PQRR-HXQR Information Disclosure via Flags override link

Summary An information disclosure vulnerability affecting Flags SDK has been addressed. It impacted flags ≤3.2.0 and @vercel/flags ≤3.1.1 and in certain circumstances, allowed a bad actor with detailed knowledge of the vulnerability to list all flags returned by the flags discovery endpoint...

PT-2025-18186 · Unknown · Phpgurukul Covid19 Testing Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul COVID19 Testing Management System version 1.0 Description: A critical issue has been found in the PHPGurukul COVID19 Testing Management System, affecting the file /test-details.php. The manipulation of the Status argument leads to...

PT-2025-17959

Name of the Vulnerable Software and Affected Versions Serosoft Academia Student Information System SIS EagleR version 1.0.118 Description An arbitrary file upload vulnerability via writefile.php allows attackers to execute arbitrary code via ../ in the filePath parameter. This issue enables...

CVE-2025-46421

A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect. Mitigation Currently, no...

GHSA-JX4G-3XQM-62VH io.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storage

Impact Attackers could manipulate the FileRef parameter to access files on the system where the Jmix application is deployed, provided the application server has the necessary permissions. This can be accomplished either by modifying the FileRef directly in the database or by supplying a harmful...

PT-2025-27553 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 15.03.05.16 multi Description: The issue is related to a Buffer Overflow in the addWifiMacFilter function, which can be exploited via the deviceId parameter. Recommendations: For Tenda AC6 version 15.03.05.16 multi, as a...

PT-2025-17504 · Unknown · Theme Switcha

Name of the Vulnerable Software and Affected Versions: Theme Switcha versions n/a through 3.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-17580 · Codemers · Codemers Klims

Name of the Vulnerable Software and Affected Versions: Codemers KLIMS version 1.6.DEV Description: The issue allows Python code injection. A user can provide Python code as an input value for a parameter or qualifier, such as for sorting, which will get executed on the server side. Recommendation...

CVE-2025-32442

A flaw was found in Fastify. In affected versions, applications that specify different validation strategies for various content types can bypass validation by using a slightly altered content type, such as with different casing or altered whitespace before ;. Mitigation To mitigate this...