Aggregator

A vulnerability classified as critical has been found in Microsoft AutoUpdate on macOS. This vulnerability affects unknown code. The manipulation leads to link following. This vulnerability is referenced as CVE-2025-55317. The attack can only be performed from a local environment. No exploit is available. To fix this issue, it is recommended to deploy a patch.

A vulnerability was found in GIMP on macOS and classified as critical. This issue affects some unknown processing of the component TCC Handler. Such manipulation leads to incorrect default permissions. This vulnerability is referenced as CVE-2025-8672. The attack can only be performed from a local environment. No exploit is available. It is suggested to upgrade the affected component.

Perplexity AI 成为最新一家被版权所有者起诉的 AI 公司。Perplexity 的“答案引擎（answer engine）”通过搜索互联网并总结其发现的内容，为传统搜索引擎提供了一种基于 AI 的替代。大英百科全书（Encyclopedia Britannica）和韦氏词典（Merriam-Webster）指控 Perplexity 未经许可抓取了其网站内容，复制并转载其内容，侵犯了版权。Perplexity 生成的 AI 答案不可避免的会带有幻觉——即捏造的错误信息。大英百科和韦氏词典指控 Perplexity 将 AI 的幻觉归因于它们，侵犯了其商标权。它们要求赔偿并禁止 Perplexity 滥用其内容。

A vulnerability identified as critical has been detected in Microsoft Windows. Affected is an unknown function of the component Graphics. This manipulation causes type confusion. This vulnerability is handled as CVE-2025-55236. The attack can be initiated remotely. There is not any exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability categorized as critical has been discovered in Microsoft Windows. This impacts an unknown function of the component SMB. The manipulation results in improper authentication. This vulnerability is known as CVE-2025-55234. It is possible to launch the attack remotely. No exploit is available. It is best practice to apply a patch to resolve this issue.

A vulnerability categorized as problematic has been discovered in Linksys E5600 1.1.0.26. The affected element is the function verify_gemtek_header of the file checkFw.sh of the component Firmware Handler. Executing manipulation can lead to risky cryptographic algorithm. The identification of this vulnerability is CVE-2025-9146. The attack may be launched remotely. There is no exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

Apple has notified users in France of a spyware campaign targeting their devices, according to the Computer Emergency Response Team of France (CERT-FR). The agency said the alerts were sent out on September 3, 2025, making it the fourth time this year that Apple has notified citizens in the county that at least one of the devices linked to their iCloud accounts may have been compromised as part

A vulnerability identified as critical has been detected in Shenzhen Sixun Business Management System 7/11. This affects an unknown part of the file /Adm/OperatorStop. Performing manipulation results in improper authorization. This vulnerability is reported as CVE-2025-10374. The attack is possible to be carried out remotely. Moreover, an exploit is present. It is suggested to use restrictive firewalling. Once again VulDB remains the best source for vulnerability data.

Submit #639092 / VDB-323788

A vulnerability categorized as problematic has been discovered in Langchaingo 0.1.14. Affected by this issue is some unknown functionality. Such manipulation leads to improper neutralization of special elements used in a template engine. This vulnerability is documented as CVE-2025-9556. The attack can be executed remotely. There is not any exploit available. A patch should be applied to remediate this issue.

A vulnerability was found in junkurihara httpsig-rs up to 0.0.18. It has been rated as problematic. Affected by this vulnerability is an unknown functionality. This manipulation causes observable timing discrepancy. This vulnerability is registered as CVE-2025-59058. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

A vulnerability was found in Evertz 3080ipx-10G, MViP-II, cVIP, 7890IXG, CC Access Server and 5782XPS-APP-4E. It has been declared as critical. Affected is an unknown function of the component Web Management Interface. The manipulation results in improper authentication. This vulnerability is cataloged as CVE-2025-10365. The attack may be launched remotely. There is no exploit available.

A vulnerability was found in Dstack-TEE dstack up to 0.5.3. It has been classified as problematic. This impacts an unknown function of the file /data. The manipulation leads to files or directories accessible. This vulnerability is listed as CVE-2025-59054. The attack must be carried out locally. There is no available exploit. Upgrading the affected component is recommended.

A vulnerability was found in Evertz 3080ipx-10G, MViP-II, cVIP, 7890IXG, CC Access Server and 5782XPS-APP-4E and classified as critical. This affects an unknown function of the file feature-transfer-import.php of the component Web Management Interface. Executing manipulation can lead to command injection. This vulnerability is tracked as CVE-2025-10364. The attack can be launched remotely. No exploit exists.

A vulnerability has been found in hono up to 4.9.6 and classified as problematic. The impacted element is an unknown function of the component bodyLimit Middleware. Performing manipulation results in resource consumption. This vulnerability is identified as CVE-2025-59139. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

A vulnerability, which was classified as problematic, was found in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /intranet/educar_turma_tipo_cad.php. Such manipulation of the argument nm_tipo leads to cross site scripting. This vulnerability is referenced as CVE-2025-10373. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /intranet/educar_modulo_cad.php. This manipulation of the argument nm_tipo/descricao causes cross site scripting. The identification of this vulnerability is CVE-2025-10372. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability was found in OPNsense 25.1 and classified as critical. The impacted element is an unknown function of the file interfaces_bridge_edit.php. The manipulation of the argument span results in command injection. This vulnerability is known as CVE-2025-50989. It is possible to launch the attack remotely. No exploit is available.

A vulnerability identified as problematic has been detected in jasonclark getsemantic up to 040c96eb8cf9947488bd01b8de99b607b0519f7d. The impacted element is an unknown function of the file /index.php. The manipulation of the argument view leads to cross site scripting. This vulnerability is referenced as CVE-2025-9147. Remote exploitation of the attack is possible. Furthermore, an exploit is available. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability described as problematic has been identified in neurobin shc up to 4.0.3. Impacted is the function make of the file src/shc.c of the component Environment Variable Handler. The manipulation results in os command injection. This vulnerability is identified as CVE-2025-9176. The attack is only possible with local access. Additionally, an exploit exists.