For Part 2 we have nine additional vendor disclosures from Dell, HPE, QNAP (4), Rockwell Automation, and VMware (2). There are three vendor updates from Hitachi Energy, HP, and Phoenix Contact.
Dell Advisory
Dell published an advisory that discusses 22 vulnerabilities in their ThinOS 10 product. These are third-party vulnerabilities. Dell has a new version that mitigates the vulnerabilities.
HPE Advisory
HPE published an advisory that discusses four vulnerabilities in their Telco Service Orchestrator. These are third-party vulnerabilities. HPE has a new version that mitigates the vulnerabilities.
The four reported vulnerabilities are:
Improper authentication - CVE-2025-54419,
Improper neutralization of special elements - CVE-2025-5878 (exploit),
Allocation of resources without limit or throttling (2) - CVE-2025-58754 (contains POC code) and CVE-2025-8916.
QNAP Advisories
QNAP published an advisory that describes an improper authentication vulnerability in their Authenticator product. The vulnerability was reported by Andr.Ess. QNAP has a new version that mitigates the vulnerability.
QNAP published an advisory that describes an SQL injection vulnerability in their Video Station product. The vulnerability was reported by Searat and izut. QNAP has a new version that mitigates the vulnerability.
QNAP published an advisory that describes 10 vulnerabilities in their Qsync Central product. The vulnerabilities were reported by coral. QNAP has a new version that mitigates the vulnerabilities.
QNAP published an advisory that describes an unquoted search path element vulnerability in their NetBak Replicator product. The vulnerability was reported by Kazuma Matsumoto of GMO Cybersecurity. QNAP has a new version that mitigates the vulnerability.
Rockwell Advisory
Rockwell published an advisory that discusses a stack-based buffer overflow vulnerability in their Lifecycle Services products. This is a third-party (Cisco) vulnerability that is listed in CISA’s Known Exploited Vulnerability (KEV) catalog. Rockwell recommends updating Cisco product.
VMware Advisories
Broadcom published an advisory that describes three vulnerabilities in the VMware VMware vCenter and NSX products. The vulnerabilities were reported by Per von Zweigbergk and the National Security Agency. VMware has new versions that mitigate the vulnerabilities.
The three reported vulnerabilities are:
Command injection - CVE-2025-41250,
Weak password recovery mechanism for forgotten password - CVE-2025-41251, and
Observable discrepancy - CVE-2025-41252
Broadcom published an advisory that describes three vulnerabilities in the VMware Aria Operations and VMware Tools products. The vulnerabilities were reported by Maxime Thiebaut of NVISO; Sven Nobis and Lorin Lehawany of ERNW Enno Rey Netzwerke; and Tom Jøran Sønstebyseter Rønning Statnett (Norway). VMware has new versions that mitigate the vulnerabilities.
The three reported vulnerabilities are:
Privilege defined with unsafe actions - CVE-2025-41244 (exploit),
Insecure default initialization of resource - CVE-2025-41245, and
Incorrect authorization - CVE-2025-41246
Hitachi Energy Update
Hitachi Energy published an update for their MACH SCM advisory that was originally published on March 26th, 2024. The new information includes:
Updating MACH SCM affected and fixed versions,
Updating CVE-2024-2097 description and CVSS score for SCM Tools,
Adding MACH SCM Tools affected and fixed versions
HP Update
HP published an update for their Intel Processor Stream Cache advisory that was originally published on August 13th, 2025. The new information includes updating version and SoftPaq information for Business Notebooks, Business Desktops, Point-of-Sale Systems, and Thin Clients.
Phoenix Contact Update
CERT-VDE published an update for the Phoenix Contact Meltdown and Spectre vulnerabilities advisory that was originally published on March 23rd, 2018. The new information includes adding distribution.