Monthly
Hash flooding denial-of-service in libexpat 2.8.2 and 2.8.3 stems from an inverted boolean check on the return value of getentropy(), causing the library to silently proceed with a predictable hash seed whenever the entropy syscall fails. Any network-accessible application that passes attacker-controlled XML through the vulnerable libexpat versions is exposed, since an adversary can craft XML content whose keys collide in libexpat's hash tables, forcing O(n²) lookup behavior and CPU exhaustion. No active exploitation has been confirmed by CISA KEV and no public POC has been identified at time of analysis, but the unauthenticated network attack vector and libexpat's broad transitive footprint across runtimes and distributions make this a meaningful availability risk.
Copeland XWEB Pro firmware versions 1.12.1 and earlier suffer from an authentication bypass vulnerability where malformed authentication responses are incorrectly validated as legitimate, allowing unauthenticated remote attackers to gain unauthorized access. The flaw affects multiple XWEB Pro models (500d, 300d, and 500b) with a CVSS score of 8.6 indicating high severity, though no patch is currently available. An attacker exploiting this vulnerability could bypass security controls and potentially access sensitive device functionality without valid credentials.
Crux Agent versions 1.9.0 through 2.0.2 mishandle the WireGuard preshared key derived from the Crux SKA bilocation key: when a peering session negotiates SHA-512 the derived key is 64 bytes rather than the 32 bytes WireGuard requires, and the agent neither validates the size nor detects that its `wg set` command failed, so it writes an invalid key to the WireGuard configuration and only surfaces the problem when the tunnel is restarted. The confidentiality-relevant variant applies to peers that have never successfully negotiated a valid 32-byte bilocation key in a Crux C2 organization where the "Enforce SKA Use" setting is turned off, resulting in no preshared key being applied at all, which exposes intercepted tunnel traffic to decryption by an adversary holding (or later acquiring) a cryptographically relevant quantum computer - a harvest-now-decrypt-later exposure, not an immediately realizable attack. Rated CVSS 6.3 (CVSS:4.0/AV:N/AC:H/PR:N/UI:N/VC:H/VI:N/VA:N/S:N/AU:Y/R:A/V:C, unauthenticated), with no public exploit identified at time of analysis.
An entropy/random-generator failure on an Mbed TLS TLS 1.3 server (versions 3.2.0 through 3.6.6 and 4.0.0 through 4.1.0) can allow bytes to be removed from or injected into the beginning of the TLS stream, degrading integrity of the protected channel. The attack is not a normal network exploit: the prerequisite is that the attacker can first induce the server's entropy source to fail (for example via fault injection, RNG degradation, or resource exhaustion), which is why the issue is scored CVSS 2.9 (AV:L/AC:H) with integrity-only impact and no effect on confidentiality or availability. Only TLS 1.3 servers are affected - TLS 1.2 servers and client-side roles are out of scope - and no public exploit code or active exploitation has been identified at time of analysis.
Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availability. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
Unhandled error conditions in the HTTP service of BLU-IC2 and BLU-IC4 access-control appliances running firmware 1.19.5 or earlier cause the devices to return HTTP 5xx responses that can leak implementation details, an information-disclosure weakness classified as CWE-394 (Unexpected Status Code or Return Value). The authoritative assessment scores this CVSS 3.1 as AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - unauthenticated network reachability, no user interaction, low confidentiality impact only - while the published CVSS 4.0 score of 10.0 asserts high confidentiality, integrity and availability impact across scope; that discrepancy is material and must be resolved before prioritization. No public exploit code and no CISA KEV entry were identified at time of analysis, though the appliances are typically segmented on physical-security networks rather than internet-exposed.
Systemic HTTP 500 error responses in Azure Access BLU-IC2 and BLU-IC4 access controller firmware through version 1.19.5 can be induced by remote, unauthenticated requests, resulting in limited information exposure and partial availability impact as assessed under CVSS 3.1 (C:L/I:N/A:L). The condition stems from improper handling of unexpected status codes or return values (CWE-394) and affects specialized physical access control appliances. No public exploit code or CISA KEV entry was identified at time of analysis, and practical risk is narrowed by the devices' typical deployment on internal or restricted facility networks rather than the public internet.
CVE-2025-22854 is a security vulnerability (CVSS 6.9). Remediation should follow standard vulnerability management procedures.
In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
A user who can create objects in a database with plv8 3.2.1 installed is able to cause deferred triggers to execute as the Superuser during autovacuum. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Hash flooding denial-of-service in libexpat 2.8.2 and 2.8.3 stems from an inverted boolean check on the return value of getentropy(), causing the library to silently proceed with a predictable hash seed whenever the entropy syscall fails. Any network-accessible application that passes attacker-controlled XML through the vulnerable libexpat versions is exposed, since an adversary can craft XML content whose keys collide in libexpat's hash tables, forcing O(n²) lookup behavior and CPU exhaustion. No active exploitation has been confirmed by CISA KEV and no public POC has been identified at time of analysis, but the unauthenticated network attack vector and libexpat's broad transitive footprint across runtimes and distributions make this a meaningful availability risk.
Copeland XWEB Pro firmware versions 1.12.1 and earlier suffer from an authentication bypass vulnerability where malformed authentication responses are incorrectly validated as legitimate, allowing unauthenticated remote attackers to gain unauthorized access. The flaw affects multiple XWEB Pro models (500d, 300d, and 500b) with a CVSS score of 8.6 indicating high severity, though no patch is currently available. An attacker exploiting this vulnerability could bypass security controls and potentially access sensitive device functionality without valid credentials.
Crux Agent versions 1.9.0 through 2.0.2 mishandle the WireGuard preshared key derived from the Crux SKA bilocation key: when a peering session negotiates SHA-512 the derived key is 64 bytes rather than the 32 bytes WireGuard requires, and the agent neither validates the size nor detects that its `wg set` command failed, so it writes an invalid key to the WireGuard configuration and only surfaces the problem when the tunnel is restarted. The confidentiality-relevant variant applies to peers that have never successfully negotiated a valid 32-byte bilocation key in a Crux C2 organization where the "Enforce SKA Use" setting is turned off, resulting in no preshared key being applied at all, which exposes intercepted tunnel traffic to decryption by an adversary holding (or later acquiring) a cryptographically relevant quantum computer - a harvest-now-decrypt-later exposure, not an immediately realizable attack. Rated CVSS 6.3 (CVSS:4.0/AV:N/AC:H/PR:N/UI:N/VC:H/VI:N/VA:N/S:N/AU:Y/R:A/V:C, unauthenticated), with no public exploit identified at time of analysis.
An entropy/random-generator failure on an Mbed TLS TLS 1.3 server (versions 3.2.0 through 3.6.6 and 4.0.0 through 4.1.0) can allow bytes to be removed from or injected into the beginning of the TLS stream, degrading integrity of the protected channel. The attack is not a normal network exploit: the prerequisite is that the attacker can first induce the server's entropy source to fail (for example via fault injection, RNG degradation, or resource exhaustion), which is why the issue is scored CVSS 2.9 (AV:L/AC:H) with integrity-only impact and no effect on confidentiality or availability. Only TLS 1.3 servers are affected - TLS 1.2 servers and client-side roles are out of scope - and no public exploit code or active exploitation has been identified at time of analysis.
Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availability. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
Unhandled error conditions in the HTTP service of BLU-IC2 and BLU-IC4 access-control appliances running firmware 1.19.5 or earlier cause the devices to return HTTP 5xx responses that can leak implementation details, an information-disclosure weakness classified as CWE-394 (Unexpected Status Code or Return Value). The authoritative assessment scores this CVSS 3.1 as AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - unauthenticated network reachability, no user interaction, low confidentiality impact only - while the published CVSS 4.0 score of 10.0 asserts high confidentiality, integrity and availability impact across scope; that discrepancy is material and must be resolved before prioritization. No public exploit code and no CISA KEV entry were identified at time of analysis, though the appliances are typically segmented on physical-security networks rather than internet-exposed.
Systemic HTTP 500 error responses in Azure Access BLU-IC2 and BLU-IC4 access controller firmware through version 1.19.5 can be induced by remote, unauthenticated requests, resulting in limited information exposure and partial availability impact as assessed under CVSS 3.1 (C:L/I:N/A:L). The condition stems from improper handling of unexpected status codes or return values (CWE-394) and affects specialized physical access control appliances. No public exploit code or CISA KEV entry was identified at time of analysis, and practical risk is narrowed by the devices' typical deployment on internal or restricted facility networks rather than the public internet.
CVE-2025-22854 is a security vulnerability (CVSS 6.9). Remediation should follow standard vulnerability management procedures.
In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
A user who can create objects in a database with plv8 3.2.1 installed is able to cause deferred triggers to execute as the Superuser during autovacuum. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.