A vulnerability has been identified in Altair Grid Engine (All versions

Substance3D - Stager versions 3.1.5 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation …

A vulnerability has been identified in Solid Edge SE2025 (All versions

A vulnerability has been identified in Altair Grid Engine (All versions

A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML file, causing libvirt to allocate too much memory …

A vulnerability has been identified in Spectrum Power 4 (All versions

Posted by Arrigo Marchiori on Nov 11 Severity: moderate Affected versions: - Apache OpenOffice through 4.1.15 Description: Apache OpenOffice documents can contain links to other files. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, documents that used background fill images, or bullet images, linked to external files...

A vulnerability has been identified in Spectrum Power 4 (All versions

When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is not …

A vulnerability has been identified in Siemens Software Center (All versions

A vulnerability has been identified in Spectrum Power 4 (All versions

When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is not …

Posted by Arrigo Marchiori on Nov 11 Severity: moderate Affected versions: - Apache OpenOffice through 4.1.15 Description: Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, documents that used "OLE objects" linked to external files would load the contents of those...

Posted by Arrigo Marchiori on Nov 11 Severity: moderate Affected versions: - Apache OpenOffice through 4.1.15 Description: Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, documents that used "floating frames" linked to external files would load the contents of...

Posted by Arrigo Marchiori on Nov 11 Severity: moderate Affected versions: - Apache OpenOffice through 4.1.15 Description: Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources". A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause such links to be loaded without prompt. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended to...

ラベルプリンターやRFIDに関する製品を販売する株式会社サトーは2025年11月10日、海外グループ会社が利用するクラウド環境でサイバーセキュリティインシデントが発生し、個人情報を含む取引先関連情報が漏えいした可能性を公表しました。原因は、サービスプロバイダー管理下の Oracle E-Business Suite（EBS）のゼロデイ脆弱性「CVE-2025-61882」 を悪用した攻撃で、同社は...

Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

Missing authorization in Nuance PowerScribe allows an unauthorized attacker to disclose information over a network.

Attackers have exploited a now-fixed vulnerability (CVE-2025-12480) in the Gladinet Triofox platform while it was still a zero-day.

CISA has added CVE-2025-21042, a vulnerability affecting Samsung mobile devices that has been used to deliver spyware, to its KEV catalog.

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.