Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000393)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000393 advisory. Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more th...

CVE-2025-62097

creationtimestamp| type| source ---|---|--- 2025-12-31 13:48:22+00:00| seen| https://bsky.app/profile/potato.software/post/3mbbyxg5bd42r...

CVE-2025-11961

pcapetheraton is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function...

CVE-2025-48704

creationtimestamp| type| source ---|---|--- 2025-12-25 06:56:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mas75wycdl2e 2025-12-26 00:41:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mau2o5feij2v 2026-01-05 20:06:24+00:00| published-proof-of-concept|...

CVE-2025-67074

creationtimestamp| type| source ---|---|--- 2025-12-17 19:48:45+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115736636604385157 2025-12-17 21:15:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115736976510649976...

CVE-2025-39182

creationtimestamp| type| source ---|---|--- 2025-12-06 12:24:48+00:00| seen| https://bsky.app/profile/concisecyber.bsky.social/post/3m7cymxfnrf26...

SUSE CVE-2025-40241

In the Linux kernel, the following vulnerability has been resolved: erofs: fix crafted invalid cases for encoded extents Robert recently reported two corrupted images that can cause system crashes, which are related to the new encoded extents introduced in Linux 6.15: - The first one 1 has plen !...

CVE-2025-40241

CVE-2025-40241 concerns the EROFS file system in the Linux kernel. The issue arises from encoded extents handling in zmap/EROF S, where crafted/invalid extents could trigger crashes due to two problems: (1) plen values not equal to zero that are used to represent special extents, previously only ...

PT-2025-49068

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.15 and later Description The Linux kernel contains an issue related to encoded extents within the erofs filesystem. Specifically, crafted, invalid images can cause system crashes. This occurs due to improper handling of...

CVE-2025-65034

creationtimestamp| type| source ---|---|--- 2025-11-19 19:11:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5yxh3ujsu2q...

Malicious code in hokage-48 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5ea43064999a8dc1cd56f256e8cb7380a2aae83184030fae3ed0ef6a4fbeeae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-172797 Malicious code in alvino-48 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4812eb0c44d4314d8a4ff0a2919e06864a630872280cc084e6362638d021853d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-175870 Malicious code in lia-48 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e68766097a1361697be6d5fbc2c13a71b7a79845abe17e395e6bdd164d20bee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lia-48 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e68766097a1361697be6d5fbc2c13a71b7a79845abe17e395e6bdd164d20bee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-140393

Malicious code in lia-48 npm...

EUVD-2025-141282

Malicious code in ira-48 npm...

Malicious code in ira-48 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8c961134f93a9fff8dcbe1ddc1320f345b5071ddd5082b035fbe23b6a5ff5fe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-143506

Malicious code in alvino-48 npm...

Malicious code in intan-48 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68b6e59964e54b6f30324c06edaea3deea37e5b41b146b4003d614ab3d7eaa5b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

siddheshtea (1.1.6) potentially affected by unknown CVE via muklis-48 (1.0.0)

muklis-48 NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on muklis-48 and may be impacted: - siddheshtea 1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-160833...