PT-2025-40548

Name of the Vulnerable Software and Affected Versions Qsync Central versions prior to 5.0.0.1 Description A flaw exists in Qsync Central where unrestricted resource allocation can occur. A remote attacker who obtains a user account may be able to prevent other systems, applications, or processes...

CVE-2025-59489

Summary (CVE-2025-59489): Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can cause loading of library code from an unintended location, enabling code execution and potential data exfiltration if the app was built with a vulnerable Unity Editor...

PT-2025-40545

Name of the Vulnerable Software and Affected Versions Qsync Central versions prior to 5.0.0.1 Description A flaw exists in Qsync Central where unrestricted resource allocation can occur. A remote attacker who obtains a user account may be able to prevent other systems, applications, or processes...

Malware in importlib-resources

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-47886 Malicious code in importlib-resources (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1a22bec72f60bb7cc973586a56fe04d0278d14854c10f0e3ed7b88dc7dc556a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview importlib-resources is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in importlib-resources (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1a22bec72f60bb7cc973586a56fe04d0278d14854c10f0e3ed7b88dc7dc556a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF. An attacker can access internal resources, exfiltrate sensitive information, or perform unauthorized actions by sending crafted requests to internal or protected endpoints. Note: This is only exploitabl...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF. An attacker can access internal resources, exfiltrate sensitive information, or perform unauthorized actions by sending crafted requests to internal or protected endpoints. Note: This is only exploitabl...

CVE-2024-58260

A vulnerability has been identified within Rancher Manager where a missing server-side validation on the .username field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts...

i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path

...

CVE-2023-53532

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix deinitialization of firmware resources Currently, in ath11kahbfwresourcesinit, iommu domain mapping is done only for the chipsets having fixed firmware memory. Also, for such chipsets, mapping is done only if it...

CVE-2023-53505

In the Linux kernel, the following vulnerability has been resolved: clk: tegra: tegra124-emc: Fix potential memory leak The tegra and tegra needs to be freed in the error handling path, otherwise it will be leaked...

CVE-2023-53532 wifi: ath11k: fix deinitialization of firmware resources

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix deinitialization of firmware resources Currently, in ath11kahbfwresourcesinit, iommu domain mapping is done only for the chipsets having fixed firmware memory. Also, for such chipsets, mapping is done only if it...

CVE-2023-53532 wifi: ath11k: fix deinitialization of firmware resources

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix deinitialization of firmware resources Currently, in ath11kahbfwresourcesinit, iommu domain mapping is done only for the chipsets having fixed firmware memory. Also, for such chipsets, mapping is done only if it...

CVE-2023-53532: Use of Uninitialized Resource

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix deinitialization of firmware resources Currently, in ath11kahbfwresourcesinit, iommu domain mapping is done only for the chipsets having fixed firmware memory. Also, for such chipsets, mapping is done only if it...

CVE-2025-6941 LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'latepointresources' shortcode in all versions up to, and including, 5.1.94 due to insufficient input sanitization and output escapin...

PT-2025-39955

Name of the Vulnerable Software and Affected Versions LatePoint – Calendar Booking Plugin for Appointments and Events versions through 5.1.94 Description The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is...

BOLD Workplanner security vulnerabilities

Bold Workplanner is an enterprise software for human resource management from the Spanish company Bold Workplanner. Bold Workplanner suffers from an insecure direct object reference vulnerability that can be exploited by an attacker to access calendar details using an unauthorized internal...

CVE-2025-59932

Flag Forge is a Capture The Flag CTF platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unauthorized users to create, modify, or delete resources on the...