Affected: Ruijie Reyee RG-ES208GC

Heap-based Buffer Overflow vulnerability in Ruijie Reyee RG-ES208GC (at least) allows Overflow Buffers.This issue affects at least RG-ES208GC - Reyee - Ruijie equipments.

Discovered on a honeypot operated by CIRCL.

Affected: pandora-analysis pandora

Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract() without applying an extraction filter.

An attacker able to submit a specially crafted TAR archive containing malicious member paths, such as paths using ../ sequences or absolute paths, could cause extrac…

Affected: KGUARD_firmware

Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. A remote unauthenticated attacker with network access to the affected service can execute arbitrary system commands on the device, potentially resulting in complete compromise of the DVR.

The vulnerability is known to have been exploited in the wild by the Mirai_ptea (Rimasuta) and …

Affected: windchill FlexPLM, Windchill PDMLink

Improper Control of Generation of Code ('Code Injection') vulnerability in windchill FlexPLM, Windchill PDMLink.This issue affects FlexPLM: through 13.0.3.0; PDMLink: through 13.0.3.0.

Affected: Eir D1000

Improper Input Validation vulnerability in Eir D1000 allows Input Data Manipulation.This issue affects D1000: through  2.00(AADU.5)_20150909

Affected: gnupg gpg-agent

A crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped

session key (AES Key Wrap ciphertext) can cause a stack buffer overflow in

gpg-agent during PKDECRYPT --kem=CMS handling. The root cause is an

unbounded session key length derived from attacker-controlled ciphertext

and used as the AES Key Wrap output length when decrypting into a

fixed-size stack buffer. libgcrypt’s AES-KW unwrap copi…

Affected: gnu InetUtils

The telnetd server invokes /usr/bin/login (normally running as root) passing the value of the USER environment variable received from the client as the last parameter.

If the client supply a carefully crafted USER environment value being the string "-f root", and passes the telnet(1) -a or --login parameter to send this USER environment to the server, the client will be automatically logged in as root bypassing normal authenticati…

Affected: ffmpeg

Heap-buffer-overflow in EXIF writer for extra IFD tags | Pwno

We recently found a cool four-bytes heap-buffer-overflow in FFmpeg's `avcodec/exif` during the processing of IFDs _(Image File Directory)._ This affects `.png`, `.jpg`, `.webp`, `.avif` … the formats we use most often. The cause of this bug is very interesting, and I don’t want to spoil it here; I want you to find out.

It’s also a short in-depth dive of FFmpeg internal work…

Affected: watchguard firebox

The default configuration of WatchGuard Firebox devices through 2025-09-10 allows administrative access via SSH on port 4118 with the readwrite password for the admin account.

GNA (CIRCL): We consider this being a vulnerability and confirm available exposed devices in our constituency.

Affected: CIRCL vulnerability-lookup

A cross-site scripting (XSS) vulnerability was discovered in the handling of user-supplied input in the Comments, Bundles, and Sightings components. Untrusted data was not properly sanitized before being rendered in templates and tables, which could allow attackers to inject arbitrary JavaScript into the application. The issue was due to unsafe use of innerHTML and insufficient validation of dynamic URLs and model fields. This vulne…