MAL-2025-165091 Malicious code in riyanto-107 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector deafeac2528cff227f320fa0045a290a690a24bacd51dc09346858f922f67ef6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-64433

KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, a vulnerability was discovered that allows a VM to read arbitrary files from the virt-launcher pod's file system. This issue stems from improper symlink handling when mounting PVC disks into a VM...

CVE-2025-64437

KubeVirt is a virtual machine management add-on for Kubernetes. In versions before 1.5.3 and 1.6.1, the virt-handler does not verify whether the launcher-sock is a symlink or a regular file. This oversight can be exploited, for example, to change the ownership of arbitrary files on the host node ...

CVE-2025-64433

CVE-2025-64433 affects KubeVirt prior to 1.5.3 and 1.6.1, enabling a VM to read arbitrary files from the virt-launcher pod filesystem via improper symlink handling when mounting PVCs. The issue arises when a malicious user controls PVC contents and can create a symlink to a file in the virt-launc...

GHSA-2R4R-5X78-MVQF KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes

Summary Short summary of the problem. Make the impact and severity as clear as possible. It is possible to trick the virt-handler component into changing the ownership of arbitrary files on the host node to the unprivileged user with UID 107 due to mishandling of symlinks when determining the roo...

PT-2025-45440

Name of the Vulnerable Software and Affected Versions KubeVirt versions prior to 1.5.3 KubeVirt versions prior to 1.6.1 Description KubeVirt, a virtual machine management add-on for Kubernetes, contains a flaw where the virt-handler does not validate if the launcher-sock is a symbolic link or a...

EUVD-2022-48285

Malicious code in bioql PyPI...

EUVD-2022-48287

Malicious code in bioql PyPI...

EUVD-2022-48281

Malicious code in bioql PyPI...

EUVD-2022-48289

Malicious code in bioql PyPI...

EUVD-2022-6544

Malicious code in bioql PyPI...

Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers being written to disk for websites visited in Private Browsing Mode. This would not have persisted them in a state where they would run again, but it would have leaked Private Browsing Mode details to disk. This vulnerability affects Firefox < 107.

...

CVE-2025-55674

creationtimestamp| type| source ---|---|--- 2025-08-14 11:09:23+00:00| seen| https://seclists.org/oss-sec/2025/q3/107 2025-08-14 13:30:43+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3lweh5v4hus2o 2025-08-14 15:02:16+00:00| seen|...

Patch Tuesday: Microsoft Fixes 107 Vulnerabilities, Including 13 RCE Flaws

Microsoft’s August Patch Tuesday fixes 107 vulnerabilities, including 13 critical RCE flaws, impacting Windows, Office, Azure, and more,…...

Linux Distros Unpatched Vulnerability : CVE-2022-45421

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4. Some of these bugs showed evidence of memory...

Linux Distros Unpatched Vulnerability : CVE-2022-45417

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers being written to disk for websites visited ...

Linux Distros Unpatched Vulnerability : CVE-2022-45415

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When downloading an HTML file, if the title of the page was formatted as a filename with a malicious extension, Firefox may have saved the file with that...

CVE-2022-46879

Mozilla developers and community members Lukas Bernhard, Gabriele Svelto, Randell Jesup, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 107. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been...

Adobe InDesign 16.0 < 17.0.0 Multiple Vulnerabilities (APSB21-107) (macOS)

The version of Adobe InDesign installed on the remote macOS host is prior to 17.0.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB21-107 advisory. - Adobe InDesign versions 16.4 and earlier are affected by a Buffer Overflow vulnerability when parsing a specially...

SUSE CVE-2022-46879

Mozilla developers and community members Lukas Bernhard, Gabriele Svelto, Randell Jesup, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 107. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been...