There’s a great blog on detecting MongoBleed exploitation via Velociraptor https://blog.ecapuano.com/p/hunting-mongobleed-cve-2025-14847

🔍 HIGH severity: MongoDB flaw (CVE-2025-14847) lets unauthenticated users read uninitialized memory via zlib. Affects v3.6–8.2.3. Patch now or disable zlib compression for mitigation. Full details: https://radar.offseq.com/threat/new-mongodb-flaw-lets-unauthenticated-attackers-re-701f4a01 #OffSeq #MongoDB #Infosec #Vulnerability

[VULN] ⚠️ MongoDB alerte sur une faille à haute gravité et urge de patcher

L'éditeur met en garde contre une vulnérabilité de lecture de mémoire de gravité élevée, qui pourrait être exploitée à distance par des attaquants non authentifiés.
⬇️
🔗 Source originale : https://www.bleepingcomputer.com/news/security/mongodb-warns-admins-to-patch-severe-rce-flaw-immediately/

PoC disponible (vecteur simple, peu de prérequis techniques,
surface d’attaque large, exploitation reproductible) 👀 : mongobleed
⬇️
• Impact observé: fuite de fragments de mémoire pouvant contenir des éléments sensibles tels que des journaux internes MongoDB, l’état du serveur, des paramètres WiredTiger, des données de /proc (ex. meminfo, statistiques réseau), des chemins Docker, des UUID de connexion et des IP clients. Le PoC montre des exemples de fuites (p. ex. MemAvailable, compteurs réseau) et indique la quantité totale de données exfiltrées ainsi que le nombre de fragments uniques. ⚠️
( https://cyberveille.ch/posts/2025-12-26-cve-2025-14847-mongobleed-fuite-de-memoire-non-authentifiee-dans-mongodb-correctifs-disponibles/ )

[Advisory officiel]
👇
https://jira.mongodb.org/browse/SERVER-115508

CVE-2025-14847

typiquement, si vous avez un contrôleur #UniFi exposé veut mieux verifier les règles firewall pour bloquer...
👇
https://community.ui.com/questions/MongoDB-warns-admins-to-patch-severe-RCE-flaw-immediately/6d64c7a3-0f22-496a-9bd2-023c02fcd126#answer/20ec3b97-d0c6-4f63-b2f5-d4953be27ad3

💬
⬇️
https://infosec.pub/post/39604416

#CyberVeille #mongoDB #CVE_2025_14847

*edit 27.12 enlevé attribution incorrecte de RCE"

🔴 CVE-2025-54322 - Critical (10)

Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py. The title and oIP parameters are also used.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-54322/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda

A critical vulnerability in LangChain Core (CVE-2025-68664) allows prompt injection and data exposure by enabling attackers to instantiate unsafe objects during serialization and deserialization. This flaw, affecting widely used functions, can lead to secret leakage and potential code execution, with patches available in versions 1.2.5 and 0.3.81.
https://securityaffairs.com/186185/hacking/langchain-core-vulnerability-allows-prompt-injection-and-data-exposure.html

Critical LangChain Core Vulnerability Exposes Secrets via Serialization Injection

https://thehackernews.com/2025/12/critical-langchain-core-vulnerability.html?m=1

> A critical LangChain Core vulnerability (CVE-2025-68664, CVSS 9.3) allows secret theft and prompt injection through unsafe serialization; updates fix

#LangChain #unsafeDeserialization

Fortinet confirms active exploitation of CVE-2020-12812.
A long-standing FortiOS SSL VPN flaw can bypass 2FA due to username case-sensitivity mismatches - especially in legacy deployments.

https://www.technadu.com/fortinet-warns-july-disclosed-ssl-vpn-flaw-is-being-used-to-bypass/616801/

Thoughts on mitigating MFA bypass risks?

#InfoSec #Fortinet #SSLVPN #MFA

Unstable stream updates: 27th December 2025

Declarative moss system-model export and import tech preview features

Moss now has the ability to use a declarative `/etc/moss/system-model.kdl` to define installed packages and repositories.

In addition, for users who prefer the classic "imperative" moss experience, it is now possible to `moss state --export` a `system-model.kdl` file of the current system to share with others.

In turn, it is also possible to one-shot `moss sync --import` an existing `system-model.kdl` file.

These features are delivered as a tech preview.

Boulder package recipe version string requirements

The Boulder packaging tool now checks for a valid recipe version string (= anything starting with an integer) and errors out if the version string is not valid.

This is necessary because our `ent` package update checking tool compares version strings to determine whether packages need an update, and will give false positives if we have a version string that looks like e.g. `v0.1.2` (note the `v`).

Highlights

- KDE Frameworks 6.21.0
- KMSCon 9.2.1 (currently not enabled by default)
- NVIDIA graphics driver 590.48.01
- discord 0.0.119
- gamescope 3.16.18
- gstreamer 1.26.10
- linux 6.17.13
- mesa 25.3.2
- sudo-rs 0.2.11
- uutils-coreutils 0.5.0
- vlc 3.22
- vscode-bin 1.107.0
- vscodium 1.107.18627
- wine 11.0-rc3
- zed 0.217.3

Other updates

Other updates include, but are not limited to:

- fastfetch
- inetutils
- inputplumber
- libdrm
- libva
- ryzenadj
- solaar
- tzdata
- wireplumber

Fixes

- Disabled LTO for the build of our recipe version checking tool `ent`, which makes `ent check updates` actually work.
- Fixed a sudo issue where using Super+T to open a cosmic-terminal in a Cosmic sesion would make sudo unable to find any commands
- Made cosmic-greeter fall back to branded background

Security Fixes:

- Patches to networkmanager and networkmanager-openvpn for CVE-2025-9615

New packages

- font-awesome-ttf 6.7.2
- lsd 1.2.0 (next gen ls command)
- swayidle 1.9.0
- yazi 25.5.31 (terminal file manager)
- yubikey-manager 5.8.0

https://github.com/orgs/AerynOS/discussions/123

#AerynOS #Linux #Rust

🔥 CRITICAL: CVE-2025-13158 in apidoc-core (0.2.0+) enables remote prototype pollution via malformed input. Risks: DoS & unpredictable JS app behavior. Audit, sanitize, and isolate now — no patch yet! https://radar.offseq.com/threat/cve-2025-13158-cwe-1321-improperly-controlled-modi-61fce7bb #OffSeq #Vulnerability #JavaScript #SupplyChain

CRITICAL: CVE-2025-68952 in eigent-ai Eigent v0.0.60 enables unauthenticated RCE over the network. Patch to 0.0.61 now! Impact: full system compromise, data loss. 🛡️ https://radar.offseq.com/threat/cve-2025-68952-cwe-94-improper-control-of-generati-d00ad68e #OffSeq #CVE202568952 #infosec #vulnerability