kernel: Bluetooth: L2CAP: Fix user-after-free

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2capchanholdunlesszero after calling l2capgetchanblah to prevent the following trace: Bluetooth: l2capcore.c:static void l2capchandestroystruct kref kref Bluetooth: chan...

kernel: Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix "bad unlock balance" in l2capdisconnectrsp conn-chanlock isn't acquired before l2capgetchanbyscid, if l2capgetchanbyscid returns NULL, then 'bad unlock balance' is triggered...

WordPress YouTube Subscribe plugin <= 3.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Title and Channel ID vulnerability

Authenticated Admin+ Stored Cross-Site Scripting via Title and Channel ID vulnerability discovered by ZAST.AI - ZAST.AI in WordPress Plugin YouTube Subscribe versions = 3.0.0...

PT-2025-47982

Name of the Vulnerable Software and Affected Versions Telegram Bot & Channel plugin for WordPress versions prior to 4.2 Description The Telegram Bot & Channel plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Telegram username. Insufficient input sanitization and outp...

WordPress plugin Telegram Bot & Channel 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

@actbase/react-native-kakao-channel contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

CVE-2025-38678

creationtimestamp| type| source ---|---|--- 2025-11-24 15:00:07+00:00| published-proof-of-concept| Telegram/5Go4y9Sp59a8HRsoMaTj0X-e6nFTkvRgJdqk6vUB2AgWKv0 2025-11-27 07:58:22+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/60913...

MAL-2025-190794 Malicious code in @actbase/react-native-kakao-channel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65c6154361619c2c8153e5a3035c559aafef406bd969d3178a240e0ed19d0a9a The package @actbase/react-native-kakao-channel was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-198883

Malicious code in @actbase/react-native-kakao-channel npm...

Malicious code in @actbase/react-native-kakao-channel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65c6154361619c2c8153e5a3035c559aafef406bd969d3178a240e0ed19d0a9a The package @actbase/react-native-kakao-channel was found to contain malicious code. Source: ghsa-malware...

AMD uProf 安全漏洞

AMD uProf is a suite of performance analysis tools from AMD for analyzing the performance of x86 architecture applications on Windows, Linux and FreeBSD systems. A return value mishandling vulnerability exists in AMD uProf, which can be exploited by an attacker to cause a KSLR bypass and loss of...

CVE-2025-64655

Improper authorization in Dynamics OmniChannel SDK Storage Containers allows an unauthorized attacker to elevate privileges over a network...

DEBIAN-CVE-2025-12888

Vulnerability in X25519 constant-time cryptographic implementations due to timing side channels introduced by compiler optimizations and CPU architecture limitations, specifically with the Xtensa-based ESP32 chips. If targeting Xtensa it is recommended to use the low memory implementations of...

UBUNTU-CVE-2025-12888

Vulnerability in X25519 constant-time cryptographic implementations due to timing side channels introduced by compiler optimizations and CPU architecture limitations, specifically with the Xtensa-based ESP32 chips. If targeting Xtensa it is recommended to use the low memory implementations of...

CVE-2025-11932 Timing Side-Channel in PSK Binder Verification

The server previously verified the TLS 1.3 PSK binder using a non-constant time method which could potentially leak information about the PSK binder...

CVE-2025-11932 Timing Side-Channel in PSK Binder Verification

The server previously verified the TLS 1.3 PSK binder using a non-constant time method which could potentially leak information about the PSK binder...

CVE-2025-11932

CVE-2025-11932 describes a timing side-channel in TLS 1.3 PSK binder verification, where a non-constant-time check could leak information about the PSK binder. The connected Nessus/OSV/DEBIAN listings corroborate a vulnerability in wolfSSL-related TLS/PSK processing and reference a changelog noti...

CVE-2025-12888 Constant Time Issue with Xtensa-based ESP32 and X22519

Vulnerability in X25519 constant-time cryptographic implementations due to timing side channels introduced by compiler optimizations and CPU architecture limitations, specifically with the Xtensa-based ESP32 chips. If targeting Xtensa it is recommended to use the low memory implementations of...

CVE-2025-12888

Vulnerability in X25519 constant-time cryptographic implementations due to timing side channels introduced by compiler optimizations and CPU architecture limitations, specifically with the Xtensa-based ESP32 chips. If targeting Xtensa it is recommended to use the low memory implementations of...

CVE-2025-12888 Constant Time Issue with Xtensa-based ESP32 and X22519

Vulnerability in X25519 constant-time cryptographic implementations due to timing side channels introduced by compiler optimizations and CPU architecture limitations, specifically with the Xtensa-based ESP32 chips. If targeting Xtensa it is recommended to use the low memory implementations of...