Live threat intelligence radar

XX-Net version 5.16.6 and earlier contain a vulnerability in the WebSocket frame parsing logic within simple_http_server.py. The server incorrectly processes unmasked WebSocket frames by always reading 4 bytes as a masking key regardless of the MASK bit, leading to corrupted application data. This flaw causes improper XOR decoding of the payload and lacks validation of RSV bits, opcode, and FIN fragmentation flags.

MobilityDB versions up to 1.3.0 contain a vulnerability in the WKB deserialization logic where a signed to unsigned conversion error allows unprivileged users to cause a denial-of-service by crashing the PostgreSQL backend. This occurs due to a negative length field in a crafted WKB payload that bypasses bounds checks and leads to out-of-bounds memory reads during memcpy operations.

CVE-2025-71385 is a reflected cross-site scripting (XSS) vulnerability in netdata versions before 2.3.1. The vulnerability occurs because the user-supplied 'love' query parameter in the /api/v2/ilove.svg and /api/v3/ilove.svg endpoints is included verbatim in the generated SVG document without proper escaping. These endpoints are accessible without authentication by default, allowing attackers to craft malicious URLs that execute scripts in the victim's browser within the netdata origin. The issue was fixed by removing the vulnerable ilove endpoints in version 2.3.1.

vLLM versions from 0.6.3 up to but not including 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. These vulnerabilities arise from inefficient regex patterns in several components, including vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint. Crafted input exploiting nested or repeated structures can cause excessive CPU usage and degrade performance, leading to denial of service. The issue is fixed in version 0.9.0.

CVE-2025-71378 is a high-severity vulnerability in picklescan versions before 0.0.30. The tool fails to detect cProfile.runctx function calls within pickle file reduce methods, allowing malicious pickle files to bypass detection. When such files are loaded using pickle.load(), they can execute arbitrary remote code.

CVE-2025-71357 is a deserialization vulnerability in picklescan versions before 0.0.30. The tool fails to detect malicious pickle files that use idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. This allows attackers to embed code in pickle files that executes remote commands when loaded.

CVE-2025-71351 is a vulnerability in picklescan versions before 0.0.25 where the tool fails to detect malicious pickle files that exploit the timeit.timeit() function in the __reduce__ method. This allows attackers to craft pickle files that import dangerous libraries such as os and execute arbitrary system commands when unpickled, bypassing picklescan detection.

CVE-2025-71348 is a deserialization vulnerability in picklescan versions before 0.0.28. The tool fails to detect malicious pickle files that exploit the torch.utils._config_module.load_config function within reduce methods. This allows attackers to craft pickle files that evade detection but execute arbitrary code during pickle.load, enabling remote code execution in supply chain attacks.

Flowise versions prior to 3.0.8 contain a cross-site scripting (XSS) vulnerability due to insufficient input filtering in chat messages and custom agent functions. This flaw allows attackers to inject malicious JavaScript, such as iframe payloads, which execute in the victim's browser and can lead to theft of cookies and session data. The vulnerability is fixed in version 3.0.8.

CVE-2025-71330 is a denial of service vulnerability in the image-size library up to version 2.0.2. It allows remote attackers to cause an infinite loop in the ICNS image parser by supplying a specially crafted ICNS buffer with a zero-valued entry length field. This infinite loop blocks the Node.js event loop permanently, causing a denial of service.