Monthly
Unauthorized remote access to Dell Secure Connect Gateway (SCG) 5.0 is possible through a logic flaw rooted in CWE-480 (Use of Incorrect Operator), affecting both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00). The incorrect operator in a security-relevant conditional-likely an authentication or authorization check-produces a logic outcome that permits access without valid credentials, consistent with the CVSS PR:N vector and the 'Authentication Bypass' classification. Real-world impact spans limited confidentiality, integrity, and availability loss per the CVSS L/L/L impact ratings; no public exploit code or CISA KEV entry has been identified at time of analysis.
Incorrect WHERE-clause evaluation in Perl's DBI::SQL::Nano (versions 1.42 up to 1.651) causes text-based '<=' and '>=' comparisons to be silently inverted, so range-filtered queries return the wrong set of rows. The flaw affects DBI's built-in fallback mini-SQL engine used by file-backed drivers (DBD::File, DBD::DBM, CSV-style) when SQL::Statement is absent, and applications that rely on such predicates for policy or authorization filtering may leak or mishandle records without any error. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; the fix is available upstream in DBI 1.651.
Remote denial of service in Envoy proxy allows attackers to crash the process by resolving a DNS name exactly 255 octets long through a configured UDP DNS filter. An off-by-one runtime precondition assumes query names are strictly less than 255 octets, contradicting RFC 1035 which permits names of up to 255 octets, so a maximally-long name that resolves successfully triggers abnormal process termination. There is no public exploit identified at time of analysis, EPSS is low (0.37%), and CISA SSVC rates exploitation as none with only partial technical impact.
A logic error in Linux kernel netfilter's AVX2-accelerated nft_set_pipapo matching allows incorrect element matching when flushing and reloading sets with composite keys (e.g., 'ipv4 . port'). The AVX2 code path prematurely returns non-matching entries during multi-field lookups, causing false collision reports when reinserting elements after a set flush. This affects netfilter firewall rule processing on systems with AVX2 CPU support. With CVSS 9.4 (AV:N/AC:L/PR:N/UI:N), the vector suggests critical network-accessible impact, though the description indicates this is a firewall rule management bug rather than a direct remote exploitation path. EPSS score of 0.02% (5th percentile) and no KEV listing suggest low real-world exploitation likelihood. Patches available across stable kernel branches 6.6.136, 6.12.83, 6.18.24, 6.19.14, and 7.0.
Packet filter (pf) rule hash calculation regression in FreeBSD causes rules with address range syntax (x.x.x.x - y.y.y.y) differing only in address ranges to be silently dropped as duplicates, loading only the first rule and potentially causing unexpected packet filtering behavior including unintended blocking or allowing of traffic. The regression affects pf's duplicate detection mechanism but does not impact rules using CIDR notation (address/mask-bits syntax). Only the first of multiple such rules is loaded, creating a silent configuration failure with no warning to administrators.
Denial of service in Apache Kafka's KRaft controller affects releases 2.8.0 through 4.2.1 and 4.3.0 through 4.3.1, where a remote authenticated principal holding CLUSTER_ACTION authorization can terminate the controller process by sending a crafted FetchSnapshotRequest whose topics array is empty or whose single topic carries no partitions. The impact is availability-only: the controller dies, taking cluster metadata management down with it, but no data is exposed or altered (assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CLUSTER_ACTION is a cluster-level permission normally held by broker/controller identities rather than ordinary producers or consumers, so the realistic attacker is a compromised or malicious broker or a holder of inter-broker credentials. No public exploit has been identified at time of analysis, no CISA KEV entry exists, and the vuln.today decision label is 'monitor'.
pyzipper before version 0.4.0 fails to use AE-2 encryption format due to an operator precedence bug, causing CRC32 checksums to be stored unencrypted in ZIP headers. Attackers with access to encrypted archives can extract plaintext CRC32 values and conduct brute-force attacks on small or low-entropy files to recover their content without decrypting the AES encryption itself. Large or high-entropy files remain practically safe under current computational constraints, but the vulnerability represents a cryptographic bypass for files under approximately 20 bytes.
CVE-2025-52985 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Use of Incorrect Operator in GitHub repository polonel/trudesk prior to 1.2.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Unauthorized remote access to Dell Secure Connect Gateway (SCG) 5.0 is possible through a logic flaw rooted in CWE-480 (Use of Incorrect Operator), affecting both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00). The incorrect operator in a security-relevant conditional-likely an authentication or authorization check-produces a logic outcome that permits access without valid credentials, consistent with the CVSS PR:N vector and the 'Authentication Bypass' classification. Real-world impact spans limited confidentiality, integrity, and availability loss per the CVSS L/L/L impact ratings; no public exploit code or CISA KEV entry has been identified at time of analysis.
Incorrect WHERE-clause evaluation in Perl's DBI::SQL::Nano (versions 1.42 up to 1.651) causes text-based '<=' and '>=' comparisons to be silently inverted, so range-filtered queries return the wrong set of rows. The flaw affects DBI's built-in fallback mini-SQL engine used by file-backed drivers (DBD::File, DBD::DBM, CSV-style) when SQL::Statement is absent, and applications that rely on such predicates for policy or authorization filtering may leak or mishandle records without any error. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; the fix is available upstream in DBI 1.651.
Remote denial of service in Envoy proxy allows attackers to crash the process by resolving a DNS name exactly 255 octets long through a configured UDP DNS filter. An off-by-one runtime precondition assumes query names are strictly less than 255 octets, contradicting RFC 1035 which permits names of up to 255 octets, so a maximally-long name that resolves successfully triggers abnormal process termination. There is no public exploit identified at time of analysis, EPSS is low (0.37%), and CISA SSVC rates exploitation as none with only partial technical impact.
A logic error in Linux kernel netfilter's AVX2-accelerated nft_set_pipapo matching allows incorrect element matching when flushing and reloading sets with composite keys (e.g., 'ipv4 . port'). The AVX2 code path prematurely returns non-matching entries during multi-field lookups, causing false collision reports when reinserting elements after a set flush. This affects netfilter firewall rule processing on systems with AVX2 CPU support. With CVSS 9.4 (AV:N/AC:L/PR:N/UI:N), the vector suggests critical network-accessible impact, though the description indicates this is a firewall rule management bug rather than a direct remote exploitation path. EPSS score of 0.02% (5th percentile) and no KEV listing suggest low real-world exploitation likelihood. Patches available across stable kernel branches 6.6.136, 6.12.83, 6.18.24, 6.19.14, and 7.0.
Packet filter (pf) rule hash calculation regression in FreeBSD causes rules with address range syntax (x.x.x.x - y.y.y.y) differing only in address ranges to be silently dropped as duplicates, loading only the first rule and potentially causing unexpected packet filtering behavior including unintended blocking or allowing of traffic. The regression affects pf's duplicate detection mechanism but does not impact rules using CIDR notation (address/mask-bits syntax). Only the first of multiple such rules is loaded, creating a silent configuration failure with no warning to administrators.
Denial of service in Apache Kafka's KRaft controller affects releases 2.8.0 through 4.2.1 and 4.3.0 through 4.3.1, where a remote authenticated principal holding CLUSTER_ACTION authorization can terminate the controller process by sending a crafted FetchSnapshotRequest whose topics array is empty or whose single topic carries no partitions. The impact is availability-only: the controller dies, taking cluster metadata management down with it, but no data is exposed or altered (assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CLUSTER_ACTION is a cluster-level permission normally held by broker/controller identities rather than ordinary producers or consumers, so the realistic attacker is a compromised or malicious broker or a holder of inter-broker credentials. No public exploit has been identified at time of analysis, no CISA KEV entry exists, and the vuln.today decision label is 'monitor'.
pyzipper before version 0.4.0 fails to use AE-2 encryption format due to an operator precedence bug, causing CRC32 checksums to be stored unencrypted in ZIP headers. Attackers with access to encrypted archives can extract plaintext CRC32 values and conduct brute-force attacks on small or low-entropy files to recover their content without decrypting the AES encryption itself. Large or high-entropy files remain practically safe under current computational constraints, but the vulnerability represents a cryptographic bypass for files under approximately 20 bytes.
CVE-2025-52985 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Use of Incorrect Operator in GitHub repository polonel/trudesk prior to 1.2.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.