MAL-2025-46550 Malicious code in vscode-resources (npm)

The package vscode-resources was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

Path Traversal

org.springframework, spring-webmvc is vulnerable to Path Traversal Vulnerability. The vulnerability is due to improper URI path canonicalization in non-compliant Servlet containers when serving static resources, which allows an attacker to bypass security restrictions and access unauthorized file...

Server-side Request Forgery (SSRF)

Overview @astrojs/cloudflare is a Deploy your site to Cloudflare Workers/Pages Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the /image endpoint. An attacker can access internal or unauthorized resources by submitting crafted URLs to the generated image...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a reference count leak that could result in an unreleased resource...

Linux nfs_local_open_fh DoS

The vulnerability of the nfslocalopenfh function in the Linux operating system’s kernel is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause service failures...

Linux pnfs_update_layout DoS

The vulnerability of the pnfsupdatelayout function in the Linux operating system is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause service failures...

Linux Heap Buffer Overflow DoS

The vulnerability of the vmcihostsetupnotify function in the mm/gup.c file of the Linux operating system’s kernel is related to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability allows an attacker to cause a service failure...

Linux apply_to_pte_range Buffer Overflow DoS

The vulnerability of the applytopterange function in the Linux operating system’s kernel is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the csdspmockwmfwaddinfo function in the Linux operating system’s kernel is related to unlimited resource allocation. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Linux kernel memdup_user DoS

The vulnerability of the memdupuser function in Linux operating systems is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Linux kernel Netfilter Heap Buffer Overflow DoS

The vulnerability of the nfconntrackfindget function in the Netfilter component of the Linux operating system is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a attacker to cause a service failure...

CVE-2025-22441

In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way to load arbitrary java code in a privileged context due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is...

CVE-2025-26452

In loadDrawableForCookie of ResourcesImpl.java, there is a possible way to access task snapshots of other apps due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

spi: fsl-qspi: use devm function instead of driver remove

...

net: stmmac: Fix accessing freed irq affinity_hint

...

crypto: iaa - Fix nr_cpus < nr_iaa case

...

Arbitrary Code Injection

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Arbitrary Code Injection via modification of the resources folder when the embeddedAsarIntegrityValidation...

GHSA-VMQV-HX8Q-J7MG Electron has ASAR Integrity Bypass via resource modification

Impact This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the...

Arbitrary Code Injection

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Arbitrary Code Injection via modification of the resources folder when the embeddedAsarIntegrityValidation and...

Linux Distros Unpatched Vulnerability : CVE-2019-10147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rkt through version 1.30.0 does not isolate processes in containers that are run with rkt enter. Processes run with rkt enter are not limited by cgroups during...