CVE-2025-12902
Improper resource management in firmware of some Solidigm DC Products may allow an attacker with local or physical access to gain un-authori
CVSS
4.4
Medio
EPSS
0.1%
p3
KEV
—
Exploit Today
1
0-100
Publicado: 7 nov 2025 · Última mod.: 7 oct 2026 · CWE-665
0.1%EPSS · 30 días0.1%
2026-09-282026-10-26
Improper resource management in firmware of some Solidigm DC Products may allow an attacker with local or physical access to gain un-authorized access to a locked Storage Device or create a Denial of Service.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1161153.1 BAJ17.9%
——5A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36. This impacts an unknown function of the file wpa_supplicantX.conf of the component WiFi Configuration. Such manipulation leads to improper initialization. The attack can only be initiated within the local network. This attack is characterized by high complexity. The exploitability is said to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.1dCVE-2026-1019577.5 ALT45.7%
——14An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause an rpd crash via an LLGR-stale route update readvertised to a configured non-LLGR peer group.12dCVE-2026-94370—26.2%
——8A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.12dCVE-2026-107175—10.7%
——3MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified.
When a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted.
Security impact:
- Stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure.
- Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing.
Preconditions:
- An authenticated user with write access to at least one MISP event.
- The user modifies the event's distribution or sharing_group_id field.
Affected versions: <2.5.4820dCVE-2026-93495—5.0%
——2Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device.
Refer to the '
Security Update for Multiple ASUS Motherboards ' section on the ASUS Security Advisory for more information.23dCVE-2026-572295.3 MED35.2%
——11Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SMTP MIME parser in rust/src/mime/smtp.rs does not fully reset state when processing Content-Type: message/rfc822 encapsulation. An outer MIME part's encoding or filename state can leak into the inner message, allowing crafted mail to evade detections based on file.data, file.name, or extracted URLs when SMTP MIME decoding is enabled. This issue is fixed in version 8.0.6.29d