Affected: unknown SCHUTZWERK-SA-2024-007

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

Metadata ========

- - Affected product: h5p-nodejs-library

the time of publication) - - Vendor: Lumi Education UG - - Problem type(s):

- CWE-20 Improper Input Validation - - CVE ID: CVE-2025-7062 - - CVE URL: https://www.cve.org/CVERecord?id=CVE-2025-7062 - - CVSS 4.0 score: 5.2 - - Advisory URL: https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-007/…

Affected: unknown usvg SVGZ decompression

# usvg SVGZ decompression bomb in `Tree::from_data`

**Author:** Khashayar Fereidani **Disclosure Date:** 2026-09-18 **Advisory:** https://fereidani.com/usvg-svgz-decompression-bomb-in-treefromdata **Contact:** https://fereidani.com/contact

## Description

`Tree::from_data` in `crates/usvg/src/parser/mod.rs:102` detects the gzip magic bytes at the start of the input and decompresses the data before parsing it…

Affected: unknown GDCM (Grassroots DICOM)

Advisory ID: SYSS-2026-071 Product: GDCM (Grassroots DICOM) Manufacturer: GDCM Project Affected Version(s): 3.3.0 Tested Version(s): 3.3.0 Vulnerability Type: Format String (CWE-134) Risk Level: Medium Solution Status: Open Manufacturer Notification: 2026-07-24 Public Disclosure: 2026-09-23 CVE Reference: Not yet assig…

Affected: unknown GDCM (Grassroots DICOM)

Advisory ID: SYSS-2026-070 Product: GDCM (Grassroots DICOM) Manufacturer: GDCM Project Affected Version(s): 3.3.0 Tested Version(s): 3.3.0 Vulnerability Type: Integer Overflow (CWE-190) Risk Level: High Solution Status: Open Manufacturer Notification: 2026-07-24 Public Disclosure: 2026-09-23 CVE Reference: Not yet assi…

Affected: unknown GDCM (Grassroots DICOM)

Advisory ID: SYSS-2026-069 Product: GDCM (Grassroots DICOM) Manufacturer: GDCM Project Affected Version(s): 3.3.0 Tested Version(s): 3.3.0 Vulnerability Type: Integer Overflow (CWE-190) Risk Level: High Solution Status: Open Manufacturer Notification: 2026-07-24 Public Disclosure: 2026-09-23 CVE Reference: Not yet assi…

Affected: unknown GDCM (Grassroots DICOM)

Advisory ID: SYSS-2026-068 Product: GDCM (Grassroots DICOM) Manufacturer: GDCM Project Affected Version(s): 3.3.0 Tested Version(s): 3.3.0 Vulnerability Type: Stack-based Buffer Overflow (CWE-121) Risk Level: High Solution Status: Open Manufacturer Notification: 2026-07-24 Public Disclosure: 2026-09-23 CVE Reference: N…

Affected: unknown GDCM (Grassroots DICOM)

Advisory ID: SYSS-2026-067 Product: GDCM (Grassroots DICOM) Manufacturer: GDCM Project Affected Version(s): 3.3.0 Tested Version(s): 3.3.0 Vulnerability Type: Stack-based Buffer Overflow (CWE-121) Risk Level: High Solution Status: Open Manufacturer Notification: 2026-07-24 Public Disclosure: 2026-09-23 CVE Reference: N…

Affected: Honeywell IQ MultiAccess Update Service

SEC Consult Vulnerability Lab Security Advisory < 20260923-0 > ======================================================================= title: Local Privilege Escalation product: Honeywell IQ MultiAccess Update Service  vulnerable version: IQ V27 & IQ V28 fixed version: IQ V27 SP1 & IQ V28 SP1          CVE number: CVE-2026-13742              impact: high homepage:h…

Affected: unknown SCHUTZWERK-SA-2024-006

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

executed in victims' browsers when viewing the affected H5P content.

Metadata ========

- - Affected product: h5p-nodejs-library - - Affected version: All versions prior to 9.3.3 - - Vendor: Lumi Education UG - - Problem type(s):

- - CVE ID: CVE-2025-47828 - - CVE URL: https://www.cve.org/CVERecord?id=CVE-2025-47828 - - CVSS 3.1 score: 6.4 (Medium) - …

Affected: unknown Server Technology PRO3X

0day Rubbish Research Team is publicly disclosing a vulnerability in Server Technology (Legrand group) PRO3X series intelligent rack PDUs, firmware spdu-pro3x-030600 build 46640 (ARM 32-bit uClibc Linux).

Type: authenticated listener program override leading to root command execution (CWE-78, CWE-269; a separate hard-coded factory credential is reported as CWE-798). PRO3X PDUs run port_mux, an inetd-style launcher that s…