Affected: Ruijie Reyee RG-ES208GC

Heap-based Buffer Overflow vulnerability in Ruijie Reyee RG-ES208GC (at least) allows Overflow Buffers.This issue affects at least RG-ES208GC - Reyee - Ruijie equipments.

Discovered on a honeypot operated by CIRCL.

Affected: pandora-analysis pandora

Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract() without applying an extraction filter.

An attacker able to submit a specially crafted TAR archive containing malicious member paths, such as paths using ../ sequences or absolute paths, could cause extracted files to be written outside the intended extraction directory. This may allow the attacker to overwrite files accessible to the Pandora worker process and could potentially result in application compromise, arbitrary code execution, or denial of service depending on the files targeted and the privileges of the Pandora process.

The vulnerability is corrected by using Python's filter='data' extraction filter, which rejects or sanitizes dangerous TAR members, including paths that escape the destination directory and unsafe link targets.

The weakness corresponds to MITRE's general path traversal category, which includes archive extraction cases where attacker-controlled filenames cause files to be written outside the intended directory.

Affected: KGUARD_firmware

Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. A remote unauthenticated attacker with network access to the affected service can execute arbitrary system commands on the device, potentially resulting in complete compromise of the DVR.

The vulnerability is known to have been exploited in the wild by the Mirai_ptea (Rimasuta) and Mirai_aurora botnets for malware propagation and subsequent DDoS activity. The vulnerability was reported to affect firmware dating from 2016, while firmware released after 2017 appears to mitigate the issue by restricting the affected service to the localhost interface (127.0.0.1) instead of exposing it on all interfaces (0.0.0.0).

The affected-device list reported by Netlab includes many D1004NR, D1008NR, D1016NR, D1104, D1104NR, D1108NR, D1116NR, D1132NR, D2116NR, D97xx, D98xx, and D99xx variants and several associated hardware revisions

The exploit is included in some version of rapperbot and exploited in 2026. This assignment has been made to document the active exploitation and lack of documentation from the vendor.

Affected: windchill FlexPLM, Windchill PDMLink

Improper Control of Generation of Code ('Code Injection') vulnerability in windchill FlexPLM, Windchill PDMLink.This issue affects FlexPLM: through 13.0.3.0; PDMLink: through 13.0.3.0.

Affected: Eir D1000

Improper Input Validation vulnerability in Eir D1000 allows Input Data Manipulation.This issue affects D1000: through  2.00(AADU.5)_20150909

Affected: gnupg gpg-agent

A crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped

session key (AES Key Wrap ciphertext) can cause a stack buffer overflow in

gpg-agent during PKDECRYPT --kem=CMS handling. The root cause is an

unbounded session key length derived from attacker-controlled ciphertext

and used as the AES Key Wrap output length when decrypting into a

fixed-size stack buffer. libgcrypt’s AES-KW unwrap copies

attacker-controlled bytes into the caller-provided output buffer before

performing integrity checks, so the stack overflow occurs even if later CMS

or key-wrap integrity validation fails.

Affected: gnu InetUtils

The telnetd server invokes /usr/bin/login (normally running as root) passing the value of the USER environment variable received from the client as the last parameter.

If the client supply a carefully crafted USER environment value being the string "-f root", and passes the telnet(1) -a or --login parameter to send this USER environment to the server, the client will be automatically logged in as root bypassing normal authentication processes.

This happens because the telnetd server do not sanitize the USER environment variable before passing it on to login(1), and login(1) uses the -f parameter to by-pass normal authentication.

Severity: High

Vulnerable versions: GNU InetUtils since version 1.9.3 up to and including version 2.7.

Affected: ffmpeg

Heap-buffer-overflow in EXIF writer for extra IFD tags | Pwno

We recently found a cool four-bytes heap-buffer-overflow in FFmpeg's `avcodec/exif` during the processing of IFDs _(Image File Directory)._ This affects `.png`, `.jpg`, `.webp`, `.avif` … the formats we use most often. The cause of this bug is very interesting, and I don’t want to spoil it here; I want you to find out.

It’s also a short in-depth dive of FFmpeg internal workings of EXIFs, something we use so often. So even if you’re not really into memory bugs, this can be a cool way to learn how it works under the hood.

Affected: watchguard firebox

The default configuration of WatchGuard Firebox devices through 2025-09-10 allows administrative access via SSH on port 4118 with the readwrite password for the admin account.

GNA (CIRCL): We consider this being a vulnerability and confirm available exposed devices in our constituency.

Affected: CIRCL vulnerability-lookup

A cross-site scripting (XSS) vulnerability was discovered in the handling of user-supplied input in the Comments, Bundles, and Sightings components. Untrusted data was not properly sanitized before being rendered in templates and tables, which could allow attackers to inject arbitrary JavaScript into the application. The issue was due to unsafe use of innerHTML and insufficient validation of dynamic URLs and model fields. This vulnerability has been fixed by escaping untrusted data, replacing innerHTML assignments with safer DOM methods, encoding URLs with encodeURIComponent, and improving input validation in the affected models.