Aggregator

A vulnerability was found in RenderDoc up to 1.26. It has been classified as critical. This vulnerability affects unknown code. This manipulation causes integer underflow. This vulnerability appears as CVE-2023-33864. The attack may be initiated remotely. In addition, an exploit is available. Upgrading the affected component is recommended.

A vulnerability marked as critical has been reported in Ubiquiti UniFi Protect Application up to 6.2.71. This affects an unknown function. Performing a manipulation results in improper authorization. This vulnerability is reported as CVE-2026-21633. The attacker must have access to the local network to execute the attack. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability has been found in n8n-io n8n up to 1.x and classified as critical. Affected by this vulnerability is an unknown functionality of the component Environment Variable Handler. Performing a manipulation of the argument NODES_EXCLUDE results in protection mechanism failure. This vulnerability is identified as CVE-2025-68668. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

A vulnerability described as problematic has been identified in Freedesktop Poppler 0.75.0/0.89.0/20.12.1/22.07.0/22.08.0. This impacts the function JBIG2Bitmap::combine of the file JBIG2Stream.cc of the component File Handler. Executing a manipulation can lead to out-of-bounds read. This vulnerability is tracked as CVE-2025-32365. The attack is restricted to local execution. No exploit exists. Upgrading the affected component is recommended.

A vulnerability marked as critical has been reported in libpng up to 1.6.50. This impacts the function png_combine_row. Performing a manipulation results in heap-based buffer overflow. This vulnerability is cataloged as CVE-2025-65018. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability marked as problematic has been reported in Freedesktop Poppler 0.75.0/0.89.0/20.12.1/22.07.0/22.08.0. This affects the function PSStack::roll. Performing a manipulation results in integer overflow. This vulnerability is identified as CVE-2025-32364. The attack is only possible with local access. There is not any exploit available. It is suggested to upgrade the affected component.

A vulnerability labeled as problematic has been found in libpng up to 1.6.50. This affects the function png_image_read_composite. Such manipulation leads to out-of-bounds read. This vulnerability is listed as CVE-2025-64720. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

A critical path traversal vulnerability in AdonisJS has been discovered that could allow remote attackers to write arbitrary files to server filesystems, potentially leading to complete system compromise. The vulnerability, tracked as CVE-2026-21440, affects the bodyparser module of the popular TypeScript-first web framework and carries a critical CVSS v4 severity rating.​ The security flaw resides in […]

The post Critical AdonisJS Vulnerability Allow Remote Attacker to Write Files On Server appeared first on Cyber Security News.

The CERT Coordination Center (CERT/CC) has disclosed details of an unpatched security flaw impacting TOTOLINK EX200 wireless range extender that could allow a remote authenticated attacker to gain full control of the device. The flaw, CVE-2025-65606 (CVSS score: N/A), has been characterized as a flaw in the firmware-upload error-handling logic, which could cause the device to inadvertently start

The current system of accountability has left much of the British government vulnerable to cyberattacks, according to a new Government Cyber Action Plan, with responsibilities for risk “unclear at all levels.”

A vulnerability was found in RenderDoc up to 1.26. It has been declared as critical. This issue affects some unknown processing. Such manipulation leads to integer overflow. This vulnerability is traded as CVE-2023-33863. The attack may be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in HotelDruid Hotel Management Software 3.0.5. It has been rated as critical. This affects an unknown part. The manipulation leads to sql injection. This vulnerability is uniquely identified as CVE-2023-33817. The attack can only be initiated within the local network. No exploit exists.

A vulnerability was found in Cloudogu SCM Manager up to 1.60 and classified as problematic. Affected by this issue is some unknown functionality. Executing a manipulation of the argument Description can lead to cross site scripting. This vulnerability is tracked as CVE-2023-33829. The attack can be launched remotely. Moreover, an exploit is present.

A vulnerability identified as critical has been detected in SumatraPDF Reader 3.4.6. This affects an unknown part of the component Text File Handler. Performing a manipulation results in buffer overflow. This vulnerability is known as CVE-2023-33802. Remote exploitation of the attack is possible. No exploit is available.

A high-severity security flaw in Open WebUI Direct Connections risks account takeover and server compromises

Google has issued its January 2026 Android Security Bulletin, urging users to update to the 2026-01-05 patch level or later to mitigate a critical vulnerability in Dolby components. The standout issue, CVE-2025-54957, targets the Dolby Digital Plus (DD+) codec and could enable out-of-bounds memory writes on affected Android devices. At the heart of this flaw […]

The post Critical Dolby Codec Vulnerability Exposes Android Devices to Code Execution Attacks appeared first on Cyber Security News.

2026年1月2日至3日，委内瑞拉发生了一次全国性互联网中断（blackout），几乎所有主要网络服务提供商的

Claims administration and risk management company Sedgwick has confirmed that its federal contractor subsidiary, Sedgwick Government Solutions, was the victim of a security breach. [...]

A vulnerability was found in Open5GS up to 2.7.6. It has been rated as problematic. Affected by this vulnerability is the function ogs_gtp2_parse_bearer_qos in the library lib/gtp/v2/types.c of the component Bearer QoS IE Length Handler. Performing a manipulation results in denial of service. This vulnerability is cataloged as CVE-2025-15418. The attack must be initiated from a local position. Furthermore, there is an exploit available. To fix this issue, it is recommended to deploy a patch.

A vulnerability categorized as problematic has been discovered in Open5GS up to 2.7.6. Affected by this issue is the function sgwc_s5c_handle_create_session_response of the file src/sgwc/s5c-handler.c of the component GTPv2-C Flow Handler. Executing a manipulation can lead to denial of service. This vulnerability is registered as CVE-2025-15419. The attack needs to be launched locally. Furthermore, an exploit is available. It is advisable to implement a patch to correct this issue.