Threats Affecting Denmark

Erlang is a programming language and runtime system for building massively scalable soft real-time systems with requirements on high availability. OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang. Packet size is not verified properly for SFTP packets. As a result when multiple SSH packets (conforming to max SSH packet size) are received by ssh, they might be combined into an SFTP packet which will exceed the max allowed packet size and potentially cause large amount of memory to be allocated. Note that situation described above can only happen for successfully authenticated users after completing the SSH handshake. This issue has been patched in OTP versions 27.2.4, 26.2.5.9, and 25.3.2.18. There are no known workarounds for this vulnerability.

HighVulnerabilityGermanyFranceUnited Kingdom+7#cve#cve-2025-26618#cwe-789

CVE-2025-58752 is a low-severity relative path traversal vulnerability in the vitejs vite development and preview servers. It allows an attacker to retrieve arbitrary HTML files from the server filesystem regardless of the configured file system access restrictions, if the Vite dev server is exposed to the network and using default or specified app types. This occurs because certain middlewares serving HTML files do not enforce allow or deny rules or root directory restrictions. The vulnerability affects vite versions prior to 5.4.20.

LowVulnerabilityGermanyFranceNetherlands+6#cve#cve-2025-58752#cwe-23

CVE-2025-69225 is a low-severity HTTP request smuggling vulnerability in aio-libs aiohttp versions prior to 3.13.3. It arises from the parser allowing non-ASCII decimal characters in the HTTP Range header, potentially enabling inconsistent interpretation of HTTP requests. Although no known exploits or impacts have been reported, this flaw could theoretically be leveraged to smuggle HTTP requests, leading to request desynchronization between front-end and back-end servers. The vulnerability is fixed in aiohttp 3.13.3. European organizations using vulnerable aiohttp versions in asynchronous Python web services should upgrade promptly to mitigate risk. Given the low CVSS score and lack of known exploits, the threat is currently low but should not be ignored in sensitive environments.

LowVulnerabilityGermanyFranceNetherlands+5#cve#cve-2025-69225#cwe-444

### Summary Improperly configuring static resource resolution in aiohttp when used as a web server can result in the unauthorized reading of arbitrary files on the system. ### Details When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if a given file path is within the root directory.This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. i.e. An application is only vulnerable with setup code like: ``` app.router.add_routes([ web.static("/static", "static/", follow_symlinks=True), # Remove follow_symlinks to avoid the vulnerability ]) ``` ### Impact This is a directory traversal vulnerability with CWE ID 22. When using aiohttp as a web server and enabling static resource resolution with `follow_symlinks` set to True, it can lead to this vulnerability. This vulnerability has been present since the introduction of the `follow_symlinks` parameter. ### Workaround Even if upgrading to a patched version of aiohttp, we recommend following these steps regardless. If using `follow_symlinks=True` outside of a restricted local development environment, disable the option immediately. This option is NOT needed to follow symlinks which point to a location _within_ the static root directory, it is _only_ intended to allow a symlink to break out of the static directory. Even with this CVE fixed, there is still a substantial risk of misconfiguration when using this option on a server that accepts requests from remote users. Additionally, aiohttp has always recommended using a reverse proxy server (such as nginx) to handle static resources and _not_ to use these static resources in aiohttp for production environments. Doing so also protects against this vulnerability, and is why we expect the number of affected users to be very low. ----- Patch: https://github.com/aio-libs/aiohttp/pull/8079/files

MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2024-23334#cwe-22

Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must convert a malicious checkpoint. The specific flaw exists within the convert_config function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28253.

HighVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2025-14928#cwe-94

The ShinyHunters hacker group claimed to have stolen over 350GB of information from European Commission cloud systems. The post European Commission Reports Cyber Intrusion and Data Theft appeared first on SecurityWeek .

LowAnalysisBelgiumFranceGermany+12

Hackers stole personal, medical, and health insurance information from the company’s internal systems. The post 3.1 Million Impacted by QualDerm Data Breach appeared first on SecurityWeek .

MediumBreachUnited StatesCanadaUnited Kingdom+7

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

HighVulnerabilityFinlandGermanyNetherlands+7#cve#cve-2026-32663#cwe-613

A broken access control may allow an authenticated user to perform a horizontal privilege escalation. The vulnerability only impacts specific configurations.

HighVulnerabilityUnited StatesGermanySweden+7#cve#cve-2026-3999#cwe-639

Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (umb-*, uui-*, ufm-*) were not filtered. This vulnerability is fixed in 16.5.1 and 17.2.2.

MediumVulnerabilityUnited StatesUnited KingdomGermany+7#cve#cve-2026-31833#cwe-79